PuzzleMask: Plain-Prose Prompt Wrappers Bypass All Tested LLM Safety Gatekeepers, Trigger Payloads in GPT-5

Check Point Research details PuzzleMask, a technique that hides policy-violating prompts inside natural-looking English prose, achieving a 100% bypass rate against four LLM gatekeepers and over 90% payload activation in GPT-5 with a Python interpreter.

Check Point Research disclosed PuzzleMask, a prompt-crafting technique that embeds policy-violating payloads inside grammatical, plain-English prose wrappers, avoiding detectable artifacts such as emojis, Base64, invisible Unicode, or other obvious encodings. In testing, 23 obfuscated prompts were submitted to four lightweight pre-screening gatekeeper models—gpt-4o-mini-2024-07-18, gpt-oss-safeguard:20b, claude-3-haiku-20240307, and llama-guard3:8b—and every one was classified as safe, a 100% bypass rate, even where policies flagged the plain unobfuscated versions. When the crafted prompts were passed to GPT-5 in Thinking mode (high reasoning) with access to a Python interpreter, the target model extracted and acted on the hidden payload in 17 of 18 trials (~94.4%); Check Point broadly describes this as 'over 90% of trials.' Successful recoveries often required more than a minute of reasoning and multiple Python executions. Researchers emphasize PuzzleMask is not itself a jailbreak but can carry a jailbreak prompt as its payload. Recommended mitigations include paraphrasing untrusted input, hardening gatekeeper policy wording, output monitoring, and defense-in-depth controls for agentic deployments.

• Technique named PuzzleMask, disclosed by Check Point Research (first report 2026-09-10, follow-up coverage 2026-09-11)
• Payloads are hidden in natural, grammatical prose with no emojis, Base64, invisible Unicode, or other encodings
• 23 crafted prompts were tested against four gatekeeper models: gpt-4o-mini-2024-07-18, gpt-oss-safeguard:20b, claude-3-haiku-20240307, and llama-guard3:8b
• All four gatekeepers classified every crafted prompt as safe — a 100% bypass rate — despite policies that flagged the plain versions
• GPT-5 Thinking (high-reasoning mode) with a Python interpreter extracted and acted on the hidden payload in 17 of 18 trials (~94.4%), described as 'over 90%' in Check Point's broader framing
• Successful payload recovery often took over a minute of reasoning plus multiple Python executions
• PuzzleMask is not a jailbreak itself but can carry a jailbreak prompt as its payload
• Mitigations recommended: input paraphrasing, hardened gatekeeper policy wording, output monitoring, and defense-in-depth controls for agentic deployments