Hackers Can Hide Malicious AI Commands Inside Normal English to Bypass Security Filters

A newly disclosed AI attack technique shows that harmful commands do not need strange symbols, hidden text, or coded strings to evade security checks.

Attackers can conceal an instruction inside ordinary English and rely on different AI models to interpret the same text differently. The method, called PuzzleMask, targets applications that put a fast screening model before a more capable AI system.

The first model may label a passage harmless because it lacks the time and tools to spot the concealed request, while the downstream model recovers it and may act.

Check Point researchers identified the issue in testing of how quick policy checks handle crafted prose. The finding matters as organizations give AI assistants access to files, code interpreters, business data, and tools that can take actions rather than simply generate text.

Check Point said in a report shared with Cyber Security News (CSN) that PuzzleMask is not a jailbreak itself. It is a way to get an unreviewed instruction before a target model, echoing risks in AI workflow identity attacks.

Hackers Can Hide Malicious AI Commands Inside Normal English

PuzzleMask wraps a policy-breaking payload in prose that looks normal to readers and lightweight gatekeepers. It does not depend on Base64, emoji strings, invisible characters, or obvious formatting tricks, making simple pattern-based checks much less useful.

The researchers used an automated process to turn short payloads into prose wrappers. Their quick-checking models were meant to block requests involving file contents, copyrighted lyrics, or local-document encryption, yet assessed every crafted wrapper as safe.

The gap comes from an imbalance in capability. A fast gatekeeper is optimized for a quick safety decision, whereas a target model may have more reasoning time and a code interpreter. It can find the hidden structure, extract the payload, and treat it as new input.

This distinction matters for teams deploying agents that read untrusted material. Reports about commands hidden in emails show the wider danger: a normal-looking message, document, or webpage can become an instruction if the system does not separate data from commands.

Across 23 crafted prompts, the gatekeepers classified wrappers as safe in every trial. Target testing covered 18 prompts, and a high-reasoning model recovered and acted on the concealed instruction in 17 cases, or 94.4 percent. The experiments used controlled mock environments and did not access or damage real files.

Defenses Must Follow the Action

The research does not show that a hidden prompt automatically defeats a target model’s built-in safety training. It shows that a front-end filter can fail to recognize the prompt, leaving downstream controls to carry the burden. That is risky when an agent has privileged tools or sensitive data.

One practical safeguard is to paraphrase untrusted content before it reaches the next stage. Rewriting text in fresh language will usually remove the structure carrying the concealed payload, though it adds cost and can reduce the original input’s quality or precision.

Organizations can strengthen gatekeeper rules to flag suspicious, self-referential wording rather than only known harmful phrases. In the tests, a specific clause about quantitative and self-referential phrases enabled a gatekeeper to catch all 23 crafted prompts, although stricter policies can increase false positives.

Input filtering alone is not enough. Security teams should monitor model outputs, tool calls, and actions, then require approval for high-impact tasks such as changing files, sending data, or running commands.

This aligns with the latest OWASP GenAI Top 10, which emphasizes limiting an agent’s authority. Developers should treat web text, emails, documents, issue comments, and logs as untrusted whenever an AI agent processes them.

Research on GitHub comment prompt attacks illustrates how external content can reach development workflows and influence automated tools.

PuzzleMask underlines a broader lesson for AI security. Natural language can serve as a delivery mechanism, so defenders must judge what an AI ultimately does, not only whether input looks suspicious.

Separating content from instructions, reducing permissions, and checking sensitive actions limit damage when an initial screen misses a hidden command and speed recovery after compromise.

Indicators of compromise (IoCs):-

Type	Indicator	Description
File name	flag.txt	Test file used in the controlled target-model experiment to verify whether a concealed file-content request was recovered and processed.

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Keep your SOC up to date on active malware & phishing within 24h of their emergence. Try ANYRUN to prevent incidents with early detection.