New AI Attack Hides Malicious Instructions in Normal-Looking Text to Evade Safety Filters

A newly disclosed prompt-crafting technique can hide policy-violating instructions inside ordinary-looking English prose, allowing malicious requests to pass through lightweight LLM safety filters before being recovered and processed by a more capable downstream model.

Researchers found that carefully structured prose can make the first model miss an embedded instruction entirely, while the target model invests enough reasoning effort to extract and act on it.

Unlike many known jailbreak and prompt-injection techniques, the method does not rely on Base64, invisible Unicode characters, emoji sequences, obvious encodings, or malformed formatting.

Instead, an automated pipeline wraps a hidden payload in grammatical, natural-language text designed to appear benign during a quick policy review.

The concealed payload could contain a request to read a local file, encrypt documents, reproduce copyrighted content, or append a conventional jailbreak instruction.

The researchers stressed that the wrapper itself is not a jailbreak: it does not make the target model ignore its internal safety policies.

Rather, it defeats an external pre-screening layer and ensures the target receives the concealed instruction for consideration.

That distinction is critical for AI agent deployments. A gatekeeper may correctly block a direct request such as “encrypt files in ~/Documents,” yet label the same request safe once it is buried within seemingly harmless prose.

OWASP classifies prompt injection as a leading LLM application risk because crafted input can alter model behavior, influence downstream systems, enable unauthorized access, or trigger unsafe actions.

The researchers generated 23 obfuscated prompts from three policy-triggering payload categories: requests to reveal a flag file, reproduce full song lyrics, and encrypt mock documents while deleting the unencrypted copies.

They tested the prompts against four gatekeeper models: OpenAI’s gpt-4o-mini-2024-07-18, gpt-oss-safeguard:20b, Anthropic’s claude-3-haiku-20240307, and Meta’s llama-guard3:8b.

Each model had previously been verified to block the same payloads when submitted in plain text.

Checkpoint Researchers said that, a common “fast gatekeeper → stronger target” architecture, where a low-cost model first classifies an incoming prompt as safe or unsafe before forwarding approved content to a more powerful, tool-enabled LLM.

In the reported trials, every gatekeeper classified the crafted wrappers as safe:

Gatekeeper	Prompts tested	Reported bypass rate
GPT-4o mini	23	100%
GPT-OSS Safeguard 20B	23	100%
Claude 3 Haiku	23	100%
Llama Guard 3 8B	5	100%

The authors noted the small sample size, particularly for Llama Guard, and reported 95% confidence intervals rather than presenting the results as a definitive measurement of all deployment configurations.

Still, the result highlights a design weakness: a small or resource-constrained classifier may lack the compute, context, tool access, or reasoning budget required to recognize a recoverable hidden message.

For target-model testing, the researchers used GPT-5 Thinking in high-reasoning mode with Python code-interpreter access.

It recovered, considered, and acted on the embedded instruction in 17 of 18 tests, a success rate of approximately 94.4%.

The recovery process was resource-intensive. In successful cases, the target reportedly spent more than a minute reasoning and executed multiple Python scripts before identifying the embedded payload.

That computational asymmetry is central to the attack: the gatekeeper sees harmless prose during a fast classification pass, while the downstream model performs deeper analysis and discovers an instruction the gatekeeper never evaluated.

The technique therefore becomes especially relevant when powerful agents can access files, browsers, shells, code interpreters, enterprise data, or third-party APIs.

An input filter that only assesses the literal surface meaning of a prompt may not be enough if the target can derive a second instruction from the text.

This expands on the broader indirect prompt-injection problem documented by Greshake et al., who showed that attacker-controlled content retrieved from web pages, emails, and other external sources can manipulate LLM-integrated applications.

It also aligns with the InjecAgent benchmark, which found that tool-integrated agents can be vulnerable to indirect injections across multiple tools and tasks.

The researchers recommend treating untrusted text as potentially executable instruction content, particularly when it originates from web pages, documents, messages, repositories, or user uploads.

One proposed control is to paraphrase incoming content before sending it to an agent. Because the concealed payload depends on a specific textual structure, semantic rewriting may destroy the encoding.

However, that safeguard can increase latency, cost, and the risk of losing important information.

A second option is to harden gatekeeper policies with detection logic for suspicious self-referential and quantitative language patterns.

In the study, adding a targeted policy clause reportedly caused GPT-4o mini to flag all 23 crafted test prompts.

This approach could introduce false positives, however, and should be evaluated against production traffic.

The more durable mitigation is defense in depth: validate input, monitor model output, restrict tools through least privilege, require user confirmation for consequential actions, isolate execution environments, and continuously audit agent behavior.

Input-only filtering is not a sufficient security boundary when a downstream model can reinterpret text, use tools, and take action.

★ Learn 7 Metric-Gated AI SOC Deployment Phases – Download Free AI SOC Deployment Playbook 2026.