PuzzleMask: Check Point Shows Plain Prose Wrappers Bypass LLM Gatekeepers
Date: 2026-09-11
Tags: prompt-injection
Executive Summary
Check Point Research published PuzzleMask on 2026-09-10: a prompt crafting method that hides a policy violating payload inside fluent English, then sends that wrapper through a fast LLM gatekeeper before a stronger target model. gpt-4o-mini, gpt-oss-safeguard 20b, and claude-3-haiku each labeled all 23 crafted trials safe; llama-guard3 missed all five lyrics wrappers it saw; gpt-5-thinking-high recovered the payload in 17 of 18 trials. Monitor target tool use and output, paraphrase untrusted input, and do not treat a cheap classifier as a control boundary.
Campaign Summary
| Field | Detail |
|---|---|
| Campaign / Malware | PuzzleMask gatekeeper bypass technique. Research, not an in the wild malware family |
| Actor / Attribution | Check Point Research disclosure. No threat actor. Confidence none |
| Target | Pipelines that run a small LLM policy check, then a stronger model with high reasoning and a code interpreter |
| Vector | Plain prose wrapper generated by an automated LLM assisted pipeline |
| Status | Disclosed. Check Point contacted Anthropic, Meta, and OpenAI from late November to mid December 2025. Opus class models terminated the interaction in Check Point's tests |
| First Observed | Research tests; public write up 2026-09-10 |
Detailed Findings
According to Check Point Research, many products put a cheap classifier in front of a capable model and tell the classifier only to emit safe or unsafe. PuzzleMask is built so the classifier never notices a hidden payload, while the target, given enough reasoning time and a Python interpreter, extracts it and treats it as further input. Check Point stated the method is not a jailbreak: it does not claim to raise the odds that the target will violate its own safety training.
Check Point reported a 100 percent gatekeeper miss rate on the trials it ran, and about 94.4 percent target recovery on 18 gpt-5-thinking-high trials. Check Point said every successful extraction used more than a minute of thinking time and more than two executed Python scripts.
Check Point tested 23 crafted prompts from three plain payloads: print the last word of a flag file, print copyrighted lyrics, and encrypt documents then delete the plaintext copies. Encrypt tests used an emulated desktop with mock files. Gatekeepers were gpt-4o-mini-2024-07-18, gpt-oss-safeguard:20b, claude-3-haiku-20240307, and llama-guard3:8b. llama-guard3 was tested only on the five lyrics prompts against its built in policy. The other three gatekeepers each saw all 23 wrappers. All four flagged the same payloads when they were written in the clear.
Check Point redacted the wrapper construction and did not publish a working generator. The public samples are censored prose. Check Point said tone and topic are not required; an early prototype used a modified opening of a novel. The lab said it is not providing reproduction artifacts.
On the target side, Check Point used gpt-5-thinking with reasoning set to high and the code interpreter on, corresponding at the time to gpt-5-2025-08-07. The attack failed against Anthropic Opus class models, which Check Point attributed to a classifier that stops the session when it detects obfuscated prompt processing. Check Point offered the full prompts and pipeline to Anthropic, Meta, and OpenAI before publication.
Check Point listed mitigations with costs: paraphrase untrusted input before the gatekeeper, which should strip the embedding but adds latency and can degrade the prompt; add a policy clause that flags phrases that are both quantitative and self referent about the whole text, which caught all 23 samples on gpt-4o-mini in a follow up test but will produce false positives; monitor model output and tool calls rather than input only; or run a gatekeeper as strong as the target, which Check Point called impractical for most deployments.
No in the wild campaign, CVE, domain, or hash was published.
MITRE ATT&CK Mapping
| Technique | ID | Context |
|---|---|---|
| Masquerading | T1036 | Policy violating instructions are wrapped in fluent prose so a classifier labels them benign |
| Command and Scripting Interpreter: Python | T1059.006 | Target recovery in Check Point's tests required a Python interpreter and multiple scripts |
| Impair Defenses | T1562 | Fast LLM policy checks are skipped while the stronger model still sees the payload |
IOCs
Domains
No domain IOCs published by sourceFull URL Paths
No URL IOCs published by sourceSplunk Format
No IOCs available for Splunk queryFile Hashes
No hash IOCs published by sourceDetection Recommendations
Log gatekeeper verdicts next to target tool calls. Alert when a classifier returns safe and the downstream model then spends more than a minute with repeated code interpreter runs on the same user turn. Treat long fluent prompts that contain self referential quantitative phrases as a hunt pivot, matching Check Point's extra policy clause, but expect false positives. Do not rely on detectors that only look for Base64, emoji smuggling, or Unicode tags. For Opus and similar models that already terminate on obfuscated processing, keep that fail closed behavior. Paraphrase untrusted web or document text before it reaches an agent that can encrypt files or run shell.
References
- [Check Point Research] PuzzleMask: Abusing Plain Prose as a Covert AI Attack Vector (2026-09-10): https://research.checkpoint.com/2026/puzzlemask-abusing-plain-prose-as-a-covert-ai-attack-vector/