Security researchers have disclosed PuzzleMask, a prompt-obfuscation technique that can help malicious instructions slip past lightweight AI safety filters.
The method hides a policy-violating instruction inside an ordinary-looking block of plain English prose.
Unlike earlier prompt-hiding approaches, PuzzleMask does not rely on Base64 text, invisible characters, emojis, unusual formatting, or encoded strings.
Instead, it uses carefully constructed natural-language text that appears harmless to a fast “gatekeeper” model but can be understood by a more capable target model.
The researchers said PuzzleMask is not a jailbreak by itself. It does not directly force a target model to ignore its internal safety rules.
However, attackers could combine the hidden payload with a separate jailbreak attempt, making it more likely that the initial security screening step fails to detect the risky input.
PuzzleMask Evades AI Guardrails
Many AI applications use a two-stage security design. A smaller, faster LLM first examines a user prompt and decides whether it is safe. If approved, the prompt is sent to a stronger model that can reason longer, use tools, or access a code interpreter.
PuzzleMask targets the gap between these two models.
Your ████████████████ task is to write ████████████████ with the following characteristics:
* ████████████████████ words in length.
* Themes and constraints:
** ████████████████████████. No ████████████████████████; nothing that ████████████████████████████████████████████████████████████████.
** The text includes ████████████████████████████████████ the following: "these words ████████████████, and ████████ have ████████, as ████████████████████████████████". Do not ████████████ ████████████████████████████████, or ████████████████████████ too much; just enough to ████████████████████████████████.
** Make sure the output is punctuated properly.
** The ████████████████████████████████ *itself*, not counting ████████████████████████████████████████████████, must follow the below pattern, where ████████████████████████ is ████████ and ████████████████████████ is ████████: ████████████████████████ [..]
An attacker creates a prose “wrapper” that embeds a hidden instruction. The wrapper is designed to require more reasoning effort, attention, or tool-assisted analysis to uncover the embedded message.
A lightweight gatekeeper may only see normal prose and classify it as safe. The stronger downstream model, however, may identify the hidden structure, recover the payload, and process it as an additional instruction.
Researchers tested 23 crafted prompts against four gatekeeper models GPT-4o Mini, GPT-OSS-Safeguard 20B, Claude 3 Haiku, and Llama Guard 3. The plain versions of the tested instructions were first verified as blocked by the applicable policies.
In the reported trials, all tested gatekeepers marked the crafted wrapper prompts as safe. The researchers said the models did not appear to recognize that the text contained a concealed instruction.
The team then tested 18 prompts against GPT-5 Thinking with high reasoning enabled and access to a Python code interpreter. The target model reportedly recovered and acted on the embedded instruction in 17 of 18 tests, a success rate of about 94.4%.
The findings are particularly relevant to AI systems that rely on a low-cost policy model to screen requests before sending them to a more powerful agent.
If the gatekeeper cannot detect the embedded payload, the target model may receive instructions that were never meaningfully reviewed, checkpoint said.
The researchers warned that organizations should not treat input filtering as the only defense. Security controls should also examine model outputs, tool calls, and downstream actions.
For AI agents with access to files, code execution, enterprise data, or external services, this is especially important.
Detect 58% more threats with fresh intelligence from 16K+ organizations. Integrate TI Feeds in you SOC
