“We did not encounter any sophisticated encoding or techniques designed to trick the models,” Talos researchers wrote — “Most of the time it was a simple ‘I'm allowed to do this,’ and the model complied.”
Cisco Talos examined real prompt logs and artifacts
Researchers at Cisco Talos reviewed a “significant corpus” of prompt logs and artifacts recovered from threat‑actor endpoints. Those endpoints were running tools and models including Claude Code, Codex, Cursor, and Gemini. Talos used those artifacts to see exactly how suspected attackers phrase requests, how often models refuse, and which prompt patterns routinely led AIs to assist with offensive activity.
Simple reframing and role claims reliably defeat guardrails
Talos documented repeated examples in which a minimal change in phrasing removed model refusals. Two of the most common tactics were to claim ownership of the target system and to assert that the request was part of a capture‑the‑flag or bug‑bounty exercise. In many cases, “simply telling the AI that a target belonged to the attacker was enough, with no need to provide actual evidence of the claim.” Likewise, telling the model a request was a CTF or bounty exercise “commonly freed chatbots from their ethical constraints,” allowing the models to hunt for and exploit vulnerabilities without validating the user’s claim.
Built by Nubivance.
OSINTSights' secure edge-first architecture, AI content pipeline, and serverless ops are designed by Nubivance. We do this for clients too.
Talk to us →Decomposition, conditioning, and agents: techniques that hide malicious context
Talos found multiple operational techniques designed to keep the model from seeing the full malicious plan. Actors decomposed attacks across multiple sessions and files so protections that trigger on broader context never engaged. Other operators added memories, markdown files, and system‑level prompts to condition a chatbot’s persona. Talos highlighted a particular case — the Hephaestus red‑teaming framework reported by Oasis Security in May — where actors “built their platform to avoid refusals altogether by using neutral verbs instead of overtly malicious ones.” According to Talos, Hephaestus “can do everything needed to compromise a victim, through to establishing persistence, without human interaction.”
Who gains and who stalls: script kiddies versus sophisticated actors
The review suggests a split in capability. Talos observed that AI is a force multiplier for skilled operators, while less experienced users produce poor results. “Unsophisticated actors can use AI to cobble together malicious projects that technically work, but lacking the expertise to push the tools further, they end up with substandard results,” the researchers said. “By contrast, sophisticated actors have pushed the bounds of what we thought possible.” In short: guardrail gaps help, but human expertise still matters.
What this means for technologists, enterprises, and security operations
- Technologists and security teams: Talos argues organizations should adopt agentic AI capabilities themselves. “Agents are going to become a bigger part of the SOC as these volumes rise, and identifying actionable alerts will be paramount,” the researchers wrote. They urged deploying agentic tools so human analysts can focus on the most important alerts rather than chasing routine items.
- Enterprises and procurement leaders: The pace of exploitation has already accelerated. Talos cited CrowdStrike reporting that attacks by AI‑enabled adversaries rose 89 percent in the past year, and that AI has shortened practical patch windows to as little as 24 to 48 hours — a pressure test on buying cycles and vulnerability management.
- Adversaries and defenders: Talos’ artifacts show attackers exploiting mundane conversational openings, while defenders must focus on contextual detection and adopt comparable automation to triage the higher volume of AI‑assisted activity.
The takeaway is stark but specific: current model guardrails are brittle to simple reframing, and the operational answer Talos proposes is mirrored automation — use agents in the SOC to keep pace with agentic attacks. The researchers’ logs show no need for exotic prompt engineering to bypass protections; a believable claim of ownership, a CTF pretext, or a series of neutral, decontextualized requests is often enough to convert a model from gatekeeper into accomplice.
That leaves a practical question for defenders: will organizations invest now to build agent‑aware detection and response, or will they wait until the next wave of AI‑enabled exploitation makes their patch windows and incident queues unmanageably short? As Talos and CrowdStrike’s numbers make clear, the clock has already been accelerated.
