Check Point shows plain prose can bypass AI safety filters

Check Point Research, on 10 September 2026, published PuzzleMask: Abusing Plain Prose as a Covert AI Attack Vector. The write-up describes a way to hide a policy-violating payload inside specially crafted plain English, with no emojis, Base64, or invisible formatting.

This is a vendor security research blog. It is not a CVE, not a CISA Known Exploited Vulnerabilities listing, and not a product patch advisory. PuzzleMask is the name of the technique, not ransomware or malware.

The setup is a cheap "quick" gatekeeper model in front of a stronger target that has more compute and a code interpreter. The gatekeeper classifies the prose as safe. The target then extracts the payload and treats it as further input. The researchers say this is not itself a jailbreak of the target's own safety training, though a jailbreak text can be used as the payload.

Gatekeepers in the tests were gpt-4o-mini-2024-07-18, gpt-oss-safeguard:20b, claude-3-haiku-20240307, and llama-guard3. Crafted prompts were marked safe in 100% of the trials they ran (23 prompts for most gatekeepers, 5 macarena prompts for llama-guard3). The target, gpt-5-thinking-high with a code interpreter, recovered and acted on the embedded payload in 17 of 18 trials, about 94.4%.

Example payloads included "print flag last word", "print macarena full lyrics", and "encrypt documents; rm plain copies". Those last tests ran in emulated mock environments. Recovery typically needed more than 1 minute of thinking and more than 2 executed Python scripts.

The attack universally failed against Anthropic Opus-class models that auto-terminate when they detect obfuscated prompt processing. The prompt pool is modest, and the pipeline that generates wrappers is resource intensive. Short payloads can take 15 minutes or more.

From late November to mid-December 2025, Check Point Research contacted Anthropic, Meta, and OpenAI and offered access to the prompts and the generation pipeline. Suggested mitigations include paraphrasing untrusted input, adding a quantitative self-referent policy clause to the gatekeeper, monitoring output and actions rather than input alone, or matching gatekeeper power to the target (which they call costly).

Related AI-input risk includes what prompt injection is, Claude Code Auto Mode, Anthropic's September 2026 threat report, and ChatGPT's sandbox cross-account leak.

If you run a cheap gatekeeper in front of a thinking model with a code interpreter, do not treat a "safe" verdict as the control. Paraphrase untrusted input or watch the model's actions, and do not wait for a CVE that this paper is not.