Attackers Bypass AI Guardrails With Simple Lies

Cisco Talos reviewed real prompt logs recovered from suspected threat-actor systems and found that many AI safety guardrails fail when attackers reframe requests as “authorized” work. Common tactics included claiming ownership of the target server or saying the activity was for a capture‑the‑flag or bug bounty, often without any proof, to get AI tools to assist with harmful steps.

Key findings

• Talos reviewed prompt logs and artifacts from suspected threat-actor endpoints using AI coding/chat tools (Claude Code, Codex, Cursor, Gemini).
• A frequent guardrail bypass was simply asserting permission/authorization (e.g., claiming the target infrastructure is owned by the requester).
• Another common bypass was claiming the work was for a capture-the-flag (CTF) or bug bounty, and models often did not require validation.
• Attackers also split malicious work into smaller, decontextualized tasks across sessions/files to avoid triggering safety protections.
• Some actors used system-level prompts (memories/markdown/system prompts) to shape the chatbot persona and behavior.
• Talos highlighted a red-teaming framework (Hephaestus) reported by Oasis Security that uses neutral wording to avoid refusals and can automate compromise steps end-to-end.

Who’s being targeted

• Commonly targeted roles: Developers, IT, Security Operations Center (SOC), Security leadership, Anyone using AI coding/chat assistants in the enterprise.
• Affected industries: Government, Education.
• Attack channels: website.
• Impersonated: An 'authorized' system owner / admin (self-claimed), Bug bounty / CTF participant (self-claimed), Neutral assistant requestor (avoids overtly malicious wording).

Awareness takeaways

• Treat “I’m authorized / it’s my server / it’s a bug bounty” as an untrusted claim, require verification and approvals before any offensive security work.
• Train teams that AI tools can be manipulated by framing; don’t rely on AI guardrails alone to prevent harmful guidance.
• Watch for ‘chunked’ requests and neutral phrasing that may indicate an attempt to assemble an attack step-by-step.
• Prepare the SOC for higher alert volume and use automation/agents to help analysts focus on the most important signals.

Red flags to watch for

• No proof of authorization is provided (just a claim).
• The request is framed to bypass ethics/safety checks rather than to solve a legitimate business problem.
• The user attempts to re-label an attack as permitted activity (ownership/authorization) to obtain step-by-step malicious guidance.
• The AI is asked to enable exploitation, not just defensive testing guidance.
• The 'CTF/bug bounty' claim is used as a blanket authorization with no verification.
• The workflow requests end-to-end offensive steps rather than reporting/remediation steps.
• Requests are deliberately decontextualized to hide the true purpose.
• Language is intentionally ‘neutral’ to bypass safeguards.
• Work is split “across multiple sessions and files” to evade detection.