PuzzleMask: Abusing Plain Prose as a Covert AI Attack Vector - Check Point Research
PuzzleMask embeds policy-violating payloads in plain prose, bypassing LLM gatekeeper models at 100% rate while target models extract and execute hidden instructions in 94% of trials. The technique wraps malicious prompts in ordinary prose that gatekeeper LLMs classify as safe. Target models with reasoning capability and code interpreters extract and act on the payload. Gatekeeper bypass rate was 100% across all tested models; target execution rate was 94.4%.
Detection / Hunteropenrouter
Immediate Actions
- Add self-referent phrase detection clause to gatekeeper model policies
- Monitor target LLM code interpreter actions and output, not just input
- Paraphrase incoming user input before passing to target model
- Restrict code interpreter file system access to non-sensitive directories
Key Takeaways
- 23 crafted prompts tested against 4 gatekeeper models; all bypassed at 100% rate
- Target model gpt-5-thinking-high recovered payloads in 17 of 18 trials (~94.4%)
- Payload extraction required >1 minute reasoning time and >2 Python script executions
- Adding self-referent phrase detection clause to gatekeeper policy caught all 23 prompts
- Disclosed to Anthropic, Meta, and OpenAI in late November to mid-December 2025
Attack Chain
- Crafting: Automated pipeline embeds arbitrary payload in obfuscated plain prose wrapper
- Screening: Gatekeeper LLM evaluates prompt and classifies it as safe
- Forwarding: Prompt passes to target LLM with high reasoning and code interpreter access
- Extraction: Target model runs Python scripts and extended reasoning to recover hidden payload
- Execution: Target model acts on payload (encrypts files, prints secrets, executes commands)
Affected Systems
- LLM pipelines using gatekeeper-to-target architecture
- gpt-4o-mini-2024-07-18 as gatekeeper
- gpt-oss-safeguard:20b as gatekeeper
- claude-3-haiku-20240307 as gatekeeper
- llama-guard3:8b as gatekeeper
- gpt-5-thinking-high as target model
Detection Availability
No detection rules or queries are published in the source article.
Detection Engineering Assessment
Hypotheses are starting points derived from the article, not findings about your environment; validate against your own telemetry.
| Dimension | Rating | Rationale |
|---|---|---|
| EDR Visibility | Low | Attack occurs within LLM API calls and code interpreter sandbox, not traditional endpoint processes. |
| Network Visibility | None | No network indicators; all activity is within LLM platform API calls. |
| Detection Difficulty | Hard | Requires monitoring LLM behavior and output rather than input alone; no traditional indicators exist. |
Hunting Hypotheses
| Hypothesis | Telemetry | Stage | FP Risk |
|---|---|---|---|
| Gatekeeper LLM issues high-confidence safe verdicts on unusually long prose inputs containing self-referent quantitative phrases (T1027) | LLM gatekeeper classification logs with input length | Defense Evasion | Medium — legitimate creative writing may contain self-referent phrases |
| Target LLM executes multiple Python scripts on a single user prompt requiring extended reasoning time (T1059) | LLM code interpreter execution logs and reasoning duration | Execution | Low — multi-script execution on simple-looking input is atypical |
| LLM code interpreter issues file encryption or deletion commands following receipt of prose-only user input (T1486, T1565.001) | Code interpreter command execution logs | Impact | Low — encryption and deletion in interpreter sandbox is suspicious |
Required Log Sources
- LLM API request and response logs
- LLM code interpreter execution logs
- LLM gatekeeper classification logs
- LLM reasoning token usage metrics
- File system access logs in interpreter sandbox
Key Behavioral Indicators
- Gatekeeper safe verdicts on unusually long prose prompts
- Target model executing >2 Python scripts on single simple-looking prompt
- Target model spending >1 minute reasoning on short-looking input
- Self-referent quantitative phrases in prompt text
- Gpg symmetric encryption commands in code interpreter logs
- File deletion commands following encryption in interpreter sandbox
Control Gaps
- Input-only monitoring misses payload execution by target model
- Gatekeeper models lack reasoning depth to detect steganographic prompts
- No behavioral monitoring of LLM code interpreter file operations
- Gatekeeper policies do not flag self-referent quantitative phrases by default
False Positive Assessment
Medium — self-referent quantitative phrases appear in legitimate creative writing and poetry; policy clause mitigation may flag benign prose.
Recommendations
Suggestions to evaluate against your own environment, tooling, and incident-response procedures — not directives.
Infrastructure Hardening
- Deploy output monitoring on target LLM code interpreter executions
- Block file encryption and deletion commands in interpreter sandbox
- Implement reasoning time thresholds for target model per prompt
- Isolate LLM code interpreter environments from production data
User Protection
- Restrict LLM code interpreter from accessing credential files
- Block gpg and rm commands in LLM interpreter sandbox
- Enforce read-only file system access for LLM code interpreter where possible
Security Awareness
- Train developers on gatekeeper-to-target pipeline vulnerabilities
- Include prompt injection testing in LLM application security reviews
MITRE ATT&CK Mapping
Execution
Stealth
Credential Access
Collection
Plain-Language Summary
Researchers found a way to hide harmful instructions inside ordinary-looking text so that safety-checking AI models do not notice them. A stronger AI model can still extract and follow those hidden instructions, potentially encrypting files or printing secret data. Organizations using AI models to screen user input before passing it to a more powerful model are affected. Add specific detection rules to the screening model and monitor what the powerful model actually does.
Additional IOCs
- Command Lines:
- Purpose: Encrypt documents using GPG symmetric encryption with a passphrase extracted from a token file | Tools:
gpg,cat,rm| Stage: Execution - Purpose: Delete original plaintext files after encryption | Tools:
rm| Stage: Impact |rm <filename1> <filename2> - Purpose: Read token file containing encryption passphrase | Tools:
cat| Stage: Collection |cat <filename>.json
- Purpose: Encrypt documents using GPG symmetric encryption with a passphrase extracted from a token file | Tools: