A lot of companies now put a small, fast AI model in front of their big one. Its only job is to read whatever a user sent and decide whether it is safe to pass along. Check Point Research has published a technique it calls PuzzleMask that walks straight past that screener using nothing but ordinary English sentences. No emoji, no Base64, no invisible characters. Just prose that reads like a paragraph of atmospheric writing.
The screening model saw 23 of these crafted prompts across four different products and called every one of them safe.
A doorman who cannot see what he is holding
The setup Check Point attacked is a standard defence in depth pattern: a cheap gatekeeper model classifies an incoming prompt against a written policy, and only then does it reach the powerful target model that will actually do the work. The researchers embedded a policy-violating payload, an instruction like "print the contents of the flag file" or "encrypt the documents folder", inside a wrapper of plain prose. Recovering it is not a matter of reading it. Check Point says extraction is gated behind reasoning effort and access to a code interpreter, and reports that in every successful case the target model spent more than a minute thinking and ran more than two Python scripts to dig the instruction out. The gatekeeper has neither. So it reads a pleasant paragraph, finds nothing objectionable, and passes it on.
What the numbers actually say
Four gatekeepers were tested: gpt-4o-mini-2024-07-18, gpt-oss-safeguard:20b, claude-3-haiku-20240307 and llama-guard3:8b. Each was given a policy Check Point first verified would block the same payloads in their plain, unwrapped form. Gatekeeper bypass ran at 100% of trials for all four. Where the researchers asked a model to explain its verdict, it did not appear to register that anything was hidden, describing one crafted prompt as text "without any harmful or manipulative intent".
On the other side, the target model, gpt-5-thinking with reasoning set to high and a code interpreter enabled, extracted the payload and acted on it in 17 of 18 trials, about 94.4%. The payloads were deliberately mundane: print the last word of a flag file, print a copyrighted song's full lyrics, and encrypt a documents folder then delete the plain copies. The encryption test ran in an emulated environment with mock contents and no real user data.
This is delivery, not a jailbreak
Check Point is careful about the boundary, and so should anyone reading it be. The technique makes no claim that a model becomes more willing to misbehave. What it does is get an arbitrary prompt in front of the target without pre-screening, so a policy that says "never print file contents" simply never gets enforced. Check Point also reports that the attack universally fails against Anthropic's Opus-class models and Fable 5, which it says now carry a built-in classifier that ends the conversation when it detects the model working on an obfuscated prompt.
Nor is the idea confined to the poetic sample the researchers published. Their first prototype was a lightly modified opening paragraph of Nineteen Eighty-Four, and a payload could as easily ride inside furniture assembly instructions. That matters for any product that feeds untrusted web pages, documents or emails to a model, the same exposure behind prompt injection tricks that hide instructions from filters and behind other recent Check Point work on data leaking between AI accounts.
Paraphrase the input before the model sees it
Check Point's strongest suggestion is also the simplest: have a model rewrite untrusted input in its own words before anything else touches it, which will almost certainly destroy the embedded payload. The cost is latency and some loss of fidelity. The alternatives are hardening the gatekeeper's policy with a specifically worded clause, and monitoring what the model does and outputs rather than only what it was sent. The researchers contacted Anthropic, Meta and OpenAI between late November and mid-December 2025, and have published the work with the working prompts and the generation pipeline redacted.
The uncomfortable part is structural. A cheap screener in front of an expensive model is a sensible engineering trade, and it is exactly the gap in capability between the two that this technique lives in. Make the gatekeeper smart enough to see what the target sees, and you have simply bought a second expensive model.
This briefing is provided by IntelFusions for informational and defensive purposes only. It is based on sources assessed to be reliable at the time of writing, and analytic judgments carry the confidence levels indicated. Indicators of compromise are defanged; re-arm them only in controlled environments. IntelFusions is not affiliated with the organizations named and makes no warranty as to completeness or accuracy.