PuzzleMask Abusing Plain Prose as a Covert AI Attack Vector

[carlospolop]

🤖 Automated Content Update

This PR was automatically generated by the HackTricks News Bot based on a technical blog post.

📝 Source Information

• Blog URL: https://research.checkpoint.com/2026/puzzlemask-abusing-plain-prose-as-a-covert-ai-attack-vector
• Blog Title: PuzzleMask: Abusing Plain Prose as a Covert AI Attack Vector
• Suggested Section: AI > AI Security, preferably as a new page such as Covert Prompt Injection and Gatekeeper-Target Mismatch, with cross-references to AI Prompts and AI Security Methodology

🎯 Content Summary

Overview and architecture: PuzzleMask is a plain-prose covert prompt-injection technique that bypasses a two-stage LLM security architecture. In the intended design, untrusted input is first sent to a fast external gatekeeper LLM. The gatekeeper is instructed not to answer or execute the request, but only to classify the input as safe or unsafe according to a policy. If the gatekeeper returns safe, the same input is forwarded to a stronger ...

🔧 Technical Details

A gatekeeper-target mismatch can be abused by sending the same attacker-controlled text to a fast policy-checking LLM and to a more capable target LLM. The attacker hides a policy-violating instruction inside fluent prose so the gatekeeper, which has limited reasoning, no interpreter, and no downstream-action monitoring, classifies the wrapper as safe. A target with higher reasoning effort and a code interpreter can analyze the wrapper, recover the hidden instruction, and process it as additional input. The payload can request file reads, protected output, destructive local actions, copyrighted content, or a second-stage jailbreak; recovery alone does not guarantee that the target will violate its own policy.

The carrier can be ordinary prose such as instructions, literary text, furniture-assembly content, or credits. The published generation method uses an automated LLM-assisted pipeline with constraints on length, punctuation, content, a self-referential quantitative phrase,...

🤖 Agent Actions

Updated src/AI/AI-Prompts.md with:

• A new Covert Plain-Prose Injection via Gatekeeper–Target Mismatch section.
• Attack prerequisites, testing methodology, impact boundaries, and technical mitigations.
• The proposed quantitative/self-referential detection rule.
• A numbered citation to the Check Point PuzzleMask research.

Used the existing prompt-security page instead of creating a redundant standalone page. git diff --check passes; mdbook was unavailable for a full build.

---

This PR was automatically created by the HackTricks Feed Bot. Please review the changes carefully before merging.

[carlospolop]

🔗 Additional Context

Original Blog Post: https://research.checkpoint.com/2026/puzzlemask-abusing-plain-prose-as-a-covert-ai-attack-vector

Content Categories: Based on the analysis, this content was categorized under "AI > AI Security, preferably as a new page such as Covert Prompt Injection and Gatekeeper-Target Mismatch, with cross-references to AI Prompts and AI Security Methodology".

Repository Maintenance:

• MD Files Formatting: 1032 files processed

Review Notes:

• This content was automatically processed and may require human review for accuracy
• Check that the placement within the repository structure is appropriate
• Verify that all technical details are correct and up-to-date
• All .md files have been checked for proper formatting (headers, includes, etc.)

Bot Version: HackTricks News Bot v1.0