Check Point shows plain prose can bypass AI safety filters

Check Point Research showed that carefully written plain English can hide a forbidden payload from AI safety filters. The 10 September 2026 write-up, PuzzleMask: Abusing Plain Prose as a Covert AI Attack Vector, uses no emojis, Base64, or invisible formatting. PuzzleMask is the name of the technique, not ransomware or malware, and there is no CVE attached.

The setup is a cheap "quick" gatekeeper model in front of a stronger target that has more compute and a code interpreter. The gatekeeper classifies the prose as safe. The target then extracts the payload and treats it as further input. The researchers say that step is not itself a jailbreak of the target's own safety training, though a jailbreak text can be used as the payload.

Gatekeepers in the tests were gpt-4o-mini-2024-07-18, gpt-oss-safeguard:20b, claude-3-haiku-20240307, and llama-guard3. Crafted prompts were marked safe in 100% of the trials they ran (23 prompts for most gatekeepers, 5 macarena prompts for llama-guard3). The target, gpt-5-thinking-high with a code interpreter, recovered and acted on the embedded payload in 17 of 18 trials, about 94.4%.

Example payloads included "print flag last word", "print macarena full lyrics", and "encrypt documents; rm plain copies". Those last tests ran in emulated mock environments. Recovery typically needed more than 1 minute of thinking and more than 2 executed Python scripts.

The attack universally failed against Anthropic Opus-class models that auto-terminate when they detect obfuscated prompt processing. The prompt pool is modest, and the pipeline that generates wrappers is resource intensive. Short payloads can take 15 minutes or more.

From late November to mid-December 2025, Check Point Research contacted Anthropic, Meta, and OpenAI and offered access to the prompts and the generation pipeline. Suggested mitigations include paraphrasing untrusted input, adding a quantitative self-referent policy clause to the gatekeeper, monitoring output and actions rather than input alone, or matching gatekeeper power to the target (which they call costly). The wrapper is a cousin of prompt injection, aimed at the cheap filter sitting in front of the thinking model.

Some offers on this page may be paid placements or contain affiliate links.