Loading story…
Check Point Research disclosed PuzzleMask, a prompt-obfuscation technique that conceals policy-violating instructions within benign-looking prose. In tests of 23 crafted prompts, four resource-constrained LLM gatekeepers marked every wrapped prompt safe even though they blocked the corresponding plaintext payloads. A GPT-5 reasoning model with Python access recovered and acted on the hidden instruction in 17 of 18 cases; researchers stressed that the wrapper is not itself a jailbreak of the target model.
The technique extends the risk posed by indirect prompt injection in LLM-integrated applications: safety controls that inspect inputs in isolation can miss instructions encoded in content subsequently interpreted by a more capable model. Organizations should not rely solely on front-end prompt filtering; they should paraphrase or normalize inputs before screening, strengthen gatekeeper policies against encoded instructions, and monitor downstream model outputs, tool calls, and other agent actions for unsafe behavior.
Track how attackers are adapting to this technology.
2 events from the most recent confirmed update back to the earliest known activity.
Check Point researchers contacted Anthropic, Meta, and OpenAI with their findings and offered access to the obfuscated prompts, target tool calls and responses, and wrapper-generation pipeline.
Check Point Research described PuzzleMask, a prose-based prompt-obfuscation technique that caused all tested gatekeeper trials to classify crafted prompts as safe. In controlled tests, GPT-5 Thinking High recovered and acted on concealed payloads in 17 of 18 trials; the researchers also proposed paraphrasing, quantitative self-reference detection, and output/tool-action monitoring as mitigations.
Follow how adversaries are adapting to this technology, and where it touches your stack today.
6 references tracked. Mallory keeps watching after this page renders.
cryptika.com
Open sourcecybersecuritynews.com
Open sourcecyberveille.ch
Open sourcemalware.news
Open sourceresearch.checkpoint.com
Open sourcearxiv.org
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Multiple writeups describe how **LLM safety controls can be bypassed through prompt-based attacks**, arguing that jailbreaks and prompt injection are a practical security problem rather than a novelty. The reporting highlights common defense layers—training-time alignment, system prompts, input classifiers, and output filters—and says each can fail because the same model that follows instructions is also asked to interpret and enforce them. One article frames jailbreaks as an attack on the trust architecture of enterprise AI deployments, while the other demonstrates the issue through Lakera’s *Gandalf* challenge, where progressively stronger controls are still defeated by prompt manipulation. The material is **not fluff** because it provides substantive security analysis of an emerging attack class affecting AI systems. Both references focus on the same topic: how prompts can subvert LLM defenses, expose protected information, and reveal architectural weaknesses in current guardrail designs. The practical takeaway for defenders is that natural-language controls alone are brittle, especially when secrets, policy enforcement, and user-controlled input share the same inference path, making prompt injection and jailbreak resistance a core application security concern for enterprise AI deployments.
Jun 29, 2026
Elastic Security Labs found that Claude Opus 4.6, used as an autonomous static reverse-engineering agent, recovered passwords from 40% of 20 evaluable binaries protected by default Tigress obfuscation. JIT obfuscation, layered virtualization, and combinations of transformations significantly increased analysis cost and time or prevented recovery altogether. Researchers developed three inexpensive protections—**Matryoshka Wall**, **Double Fond**, and **Dispatch Maze**—to exploit LLM static-analysis limits, context and budget constraints, and shortcut biases. The techniques delayed or blocked password recovery even when the model identified the broad obfuscation approach; Elastic cautioned that the protections primarily affect automated static analysis and may become less effective as agents gain dynamic execution capabilities.
Sep 9, 2026
Recent research highlights how **LLM jailbreak and prompt-manipulation attacks** can bypass safety controls, especially in *multi-turn* conversations where adversaries gradually escalate requests to elicit harmful or policy-violating output. A proposed defense framework, **HoneyTrap**, aims to counter these attacks with a *multi-agent* approach that goes beyond static filtering or supervised fine-tuning by using **adaptive, deceptive responses** intended to slow attackers and deny actionable information rather than simply refusing requests. Separately, technical analysis of the **LLM input-processing pipeline** (tokenization, embeddings, attention, and context-window behavior) explains why common guardrails like keyword filters can fail and how attackers can exploit architectural properties (including **Query-Key-Value attention dynamics**) to steer model behavior. The research describes common offensive techniques—**prompt injection, jailbreaking, and adversarial suffixes**—and frames them as practical risks for enterprise deployments, particularly **public-facing chatbots** and other systems where organizations cannot fully control user input.
Jun 29, 2026