Hackers Can Hide Malicious AI Commands Inside Normal English to Bypass Security Filters
Attackers can hide dangerous AI commands inside everyday English to bypass security filters. This lets them trick AI tools into doing things.
- Report priority
- Medium
How it works
- Attackers craft normal-looking English sentences that contain hidden instructions.
- These sentences pass quick security checks because they look harmless.
- But when the AI assistant reads them carefully, it finds the hidden command and follows it.
- This works because different AI models interpret the same text differently.
- The quick check sees only the safe-looking text, while the full AI assistant sees the hidden order.
What to do
If your company uses AI tools that can modify files, run code, or access important business data, check if those tools have a quick security filter before the full AI assistant. If so, you may be affected. Look for updates or security notices from the AI tool provider about this issue.
Contact your AI tool provider for updates or patches. Ask if they have added protections against hidden commands in text. If no fix is available, consider disabling or restricting AI tools that handle sensitive data until a solution is provided.
Technical details
Researchers at Check Point demonstrated a novel AI attack technique called PuzzleMask, which exploits a weakness in multi-stage AI filtering systems. The method embeds malicious commands within seemingly harmless English text, bypassing lightweight "gatekeeper" models designed for quick safety checks. These gatekeepers, optimized for speed, fail to detect the hidden payload, while downstream, more capable AI models extract and execute the concealed instruction.
The attack does not rely on obfuscation tricks like Base64 or invisible characters, making it resistant to simple pattern-based filters. The vulnerability affects AI systems where a fast preliminary model precedes a more powerful, reasoning-capable model (e.g., code interpreters or business tool integrations). Check Point tested 23 crafted prompts, all classified as safe by gatekeepers but successfully decoded and acted upon by the target model.
This technique underscores risks in AI workflows where untrusted input is processed without strict command/data separation.