# PuzzleMask: Abusing Plain Prose as a Covert AI Attack Vector

Plain-prose wrapper prompts hide policy-violating payloads from quick LLM gatekeepers, which classify them safe while a stronger target model extracts and executes them.

- Payout: Research
- Severity: medium
- Program: LLM gatekeeper pipelines
- Write-up by: shlomoo@checkpoint.com
- Disclosed: 2026-09-10
- Write-up quality: 7/10
- Original: https://research.checkpoint.com/2026/puzzlemask-abusing-plain-prose-as-a-covert-ai-attack-vector/
- Library page: https://bugbountylibrary.com/r/blog%3Aresearch-checkpoint-com-2026-puzzlemask-abusing-plain-prose-as-a-covert-ai-attack-vector
- Tags: area:ai domain:ai impact:integrity kind:research platform:threat-intel sev:medium tech:llm technique:chained vuln:auth-bypass vuln:prompt-injection

**Target:** LLM gatekeeper→target pipeline (policy-check classifier plus reasoning model with code interpreter)
**Root cause:** A low-resource gatekeeper LLM cannot detect a payload embedded in a plain-English prose wrapper because extraction requires high reasoning effort and code execution the gatekeeper lacks; the target model, which has those resources, recovers and acts on the payload.
**Steps:**
1. Generate an obfuscated wrapper prompt from a policy-violating payload (e.g. `print flag last word`, `encrypt documents; rm plain copies`) using an LLM-assisted pipeline that embeds the payload in plain prose with no emojis/base64/invisible formatting.
2. Submit the crafted prompt to a gatekeeper LLM (gpt-4o-mini, gpt-oss-safeguard:20b, claude-3-haiku, llama-guard3:8b) equipped with a policy that blocks the plain payload; observe it returns `safe`.
3. Pass the same prompt to a strong target model (gpt-5-thinking-high with code interpreter); it spends >1 minute reasoning and runs >2 Python scripts to extract the payload.
4. Target processes the recovered payload as further input and acts on it (prints flag word, encrypts mock documents).
**How found:** Observed that gatekeeper models are resource-constrained relative to targets; hypothesized that payload extraction is gated behind reasoning effort and code execution, then built an automated pipeline to embed payloads in plain prose and cross-tested gatekeepers vs a strong target.
**Exploitation:** Attacker submits a prose-wrapped prompt to a pipeline whose quick policy check lacks reasoning/tool access; the gatekeeper marks it safe and forwards it to the target model, which extracts and executes the hidden instruction (e.g. print flag, encrypt files, ignore prior instructions).
**Escalation:** Technique is not itself a jailbreak but can carry a jailbreak prompt as payload, combining gatekeeper bypass with target-model jailbreak.
**Insight:** When auditing a gatekeeper→target LLM pipeline, test whether the two models differ in reasoning/tool budget: embed the forbidden instruction in fluent prose that only a model able to run code and think at length can recover, and check if the cheap classifier still says safe.