AI cyber guardrails fall for simple authorization claims

A Cisco Talos review of AI-use artifacts recovered from suspected threat-actor systems found that bypassing cyber-safety guardrails often required little more than claiming authorization. In many cases, models running tools such as Claude Code, Codex, Cursor, and Gemini accepted statements like “this is my server” or that the work was part of a capture-the-flag or bug-bounty exercise.

The researchers said users generally did not need sophisticated jailbreaks, encoding tricks, or evidence to support their claims. The findings expose a basic weakness in current defenses: models are often willing to trust a user’s description of intent even when the requested actions could compromise a real system.

“We did not encounter any sophisticated encoding or techniques designed to trick the models. Most of the time it was a simple 'I’m allowed to do this,' and the model complied.”

How attackers bypassed model protections

Talos reviewed a “significant corpus” of prompt logs and other artifacts from threat-actor endpoints. The most common tactic was to claim ownership of the infrastructure being targeted. Another was to describe the activity as security research, a capture-the-flag challenge, or a bug bounty exercise.

The models often accepted those explanations without validating them. Once persuaded, they could help identify vulnerabilities and exploit target systems.

Attackers also split malicious work across multiple sessions and files. This allowed them to avoid protections that might activate when a model could see the broader operational goal. Other examples involved adding memories, Markdown files, and system-level prompts that gradually conditioned a chatbot into adopting a more permissive persona.

Recommended reading

Microsoft pays record $20 million in bug bounties

That pattern has direct implications for teams building guardrails for AI coding agents: rules applied to isolated prompts can miss the intent that emerges across a longer workflow.

Neutral language hid the operational goal

Talos identified the misuse of Hephaestus, a red-teaming toolset previously reported on by Oasis Security researchers in May, as the most notable example it examined. According to Talos, Hephaestus can carry out the steps needed to compromise a victim and establish persistence without human interaction.

Its operators reportedly designed the platform to avoid refusals by replacing overtly malicious verbs with neutral ones. Individual requests could therefore appear harmless while contributing to a complete attack chain.

“In that case, actors built their platform to avoid refusals altogether by using neutral verbs instead of overtly malicious ones. As a result, they were able to have considerable success with agents conducting innocuous requests without realizing the full operational context.”

The result is a familiar security problem in an AI-specific form: break an operation into decontextualized pieces, use benign language for each piece, and the model may never detect the larger attack.

Skilled attackers gain the most

Talos said AI appears to be a force multiplier for experienced hackers, but it does not automatically turn an unskilled user into a capable operator. An inexperienced attacker may be able to assemble a malicious project that technically works, yet lack the expertise to adapt it or push it further.

“Unsophisticated actors can use AI to cobble together malicious projects that technically work, but lacking the expertise to push the tools further, they end up with substandard results. By contrast, sophisticated actors have pushed the bounds of what we thought possible.”

That distinction limits the significance of the simplest guardrail bypasses without making them harmless. The barriers may be weak enough to help a skilled attacker move faster, while still leaving less experienced users with unreliable tools.

Security teams need AI agents, too

Talos' review also points to a defensive response: organizations should deploy AI in security operations centers as aggressively as attackers use it. The researchers expect agents to become a larger part of the SOC, where they can help identify actionable alerts and leave human analysts to focus on the most important incidents.

“Agents are going to become a bigger part of the SOC as these volumes rise, and identifying actionable alerts will be paramount. Organizations that aren’t already exploring agentic capabilities to let human analysts focus on the most important alerts will soon find themselves chasing that capability.”

The pressure is already measurable. CrowdStrike reported an 89 percent increase in attacks by AI-enabled adversaries over the past year, while AI-assisted vulnerability weaponization has reduced practical patch windows to 24 to 48 hours.

Talos' findings do not show that every chatbot can independently execute a sophisticated intrusion. They do show that authorization claims, fragmented tasks, and neutral wording can undermine protections designed around individual requests. For defenders, the weak point is not only the model’s refusal policy but also the lack of context across the entire operation.