AI Guardrails Easily Bypassed by Simple Social Engineering, Researchers Find
Cisco Talos researchers discovered that basic social engineering tactics, such as claiming ownership of systems or participation in bug bounties, can easily trick AI models into assisting with malicious activities.
Researchers from Cisco Talos have found that the guardrails implemented in many large language models (LLMs) to prevent them from assisting with cyberattacks are surprisingly easy to circumvent. By employing simple social engineering tactics, threat actors can often persuade AI models to cooperate with malicious requests. The most common method involves falsely claiming ownership of target systems or asserting that the requested actions are part of a bug bounty program or a capture-the-flag exercise.
Talos researchers analyzed a significant corpus of prompt logs and artifacts from endpoints running AI tools like Claude Code, Codex, Cursor, and Gemini. Their findings indicate that existing security measures offer minimal resistance to users willing to reframe their requests. "We did not encounter any sophisticated encoding or techniques designed to trick the models," the report states. "Most of the time it was a simple ‘I'm allowed to do this,’ and the model complied."
When AI models did refuse a request due to their safety protocols, the researchers noted that these refusals were often easily overcome. Simple claims of ownership, without any need for proof, were frequently sufficient to bypass these safeguards. Similarly, stating that a task was part of a legitimate security exercise often freed the AI from its ethical constraints, allowing it to assist in vulnerability discovery and exploitation.
Attackers are also employing more nuanced techniques, such as decomposing complex tasks into smaller, seemingly innocuous requests across multiple sessions. This approach helps evade detection by AI models that might flag a larger, overtly malicious operation. Additionally, some actors have been observed conditioning the AI's persona by providing system-level prompts, markdown files, or memory injections to influence its behavior.
A particularly interesting method highlighted by Talos involves the use of the Hephaestus red teaming toolset. This framework allows attackers to avoid refusals altogether by using neutral language for requests, masking the true malicious intent. By breaking down an attack into decontextualized steps phrased neutrally, the AI may not recognize the overall malicious context.
Despite these bypasses, Talos suggests that AI may be a greater force multiplier for skilled hackers than for novice attackers. "Unsophisticated actors can use AI to cobble together malicious projects that technically work, but lacking the expertise to push the tools further, they end up with substandard results," the researchers explained. Sophisticated actors, however, are pushing the boundaries of what is possible with AI assistance.
For security professionals, the implications are clear: AI is rapidly becoming an integral part of both offensive and defensive cybersecurity. The speed at which vulnerabilities are being weaponized with AI has reportedly reduced practical patch windows to as little as 24 to 48 hours. Organizations must adapt by integrating AI capabilities into their security operations centers (SOCs) to effectively identify and respond to AI-driven threats.
The increasing reliance on AI by threat actors necessitates a proactive approach from defenders. As AI agents become more prevalent in security operations, the ability to distinguish actionable alerts from noise will be paramount. Enterprises are urged to explore agentic capabilities to allow human analysts to focus on the most critical threats, rather than being overwhelmed by the sheer volume of alerts.