Hackers Conceal Malicious AI Commands Within Normal English to Evade Security Filters
A new AI attack technique, PuzzleMask, hides malicious commands in plain English text, bypassing security filters by exploiting differences between lightweight screening models and more capable downstream AI systems.
Researchers have uncovered a novel AI attack technique named PuzzleMask, which allows malicious commands to be embedded within seemingly innocuous English text, effectively bypassing security filters. This method exploits the architectural differences in AI systems, specifically the imbalance between fast, lightweight screening models and more powerful, reasoning-capable downstream models.
The technique does not rely on traditional obfuscation methods like Base64 encoding, invisible characters, or complex formatting. Instead, it crafts prose that appears normal to human readers and basic security checks. The core of the attack lies in how different AI models interpret the same input. A fast gatekeeper model, optimized for quick decisions and limited processing power, may assess the disguised instruction as harmless. However, a more capable downstream model, with greater reasoning capacity and potentially access to tools like code interpreters, can identify the hidden command, extract it, and execute it.
Check Point researchers demonstrated this by creating crafted prompts where lightweight gatekeeper models consistently classified the wrappers as safe. In contrast, when tested against more advanced models, a significant majority (94.4%) of these concealed instructions were successfully recovered and acted upon. These experiments were conducted in controlled, mock environments and did not involve actual data compromise or damage.
This discovery is particularly concerning as organizations increasingly grant AI agents access to sensitive resources, including files, code interpreters, and business data. The ability to hide commands within normal text means that AI assistants could be manipulated into performing harmful actions without triggering initial security alerts. This poses a significant risk to AI workflows and the integrity of data and systems they interact with.
While PuzzleMask itself is not a direct jailbreak, it represents a sophisticated method for delivering unreviewed instructions to target AI models. It highlights a broader threat landscape where natural language can serve as a potent delivery mechanism for malicious payloads. The research underscores the importance of not solely relying on input filtering but also monitoring model outputs, tool calls, and actions, especially for high-impact tasks.
Defensive strategies against PuzzleMask and similar attacks involve strengthening gatekeeper rules to flag suspicious, self-referential wording, rather than just known harmful phrases. Paraphrasing untrusted content before it reaches the next processing stage can also disrupt the structure carrying the concealed payload. Furthermore, implementing robust monitoring of AI agent outputs and requiring explicit approval for sensitive actions, such as file modifications or data exfiltration, are crucial steps.
The findings align with emerging security frameworks like the OWASP GenAI Top 10, which emphasize limiting an AI agent's permissions and privileges. Developers must treat all external content processed by AI agents—whether from web text, emails, documents, or logs—as untrusted. The PuzzleMask technique serves as a stark reminder that the ultimate security of AI systems depends on a multi-layered approach that scrutinizes not just the input's appearance but also the AI's subsequent actions.