HiddenLayer's policy puppetry prompt bypasses every major frontier model — and is built to be hard to patch
HiddenLayer's April 24 research post describes a prompting technique it calls Policy Puppetry: by rewriting a request to look like an instruction or policy document and pairing it with roleplay, a single prompt extracts content in violation of CBRN, mass-violence and self-harm policies from models across OpenAI, Google, Microsoft, Anthropic, Meta, DeepSeek, Qwen and Mistral. The researchers report the attack is both universal and transferable — it survives different architectures, chain-of-thought and reasoning inference strategies, and alignment approaches — and with minor edits it also pulls full system prompts.
The claimed root cause is a systemic weakness in how models are trained on instruction- and policy-shaped data, which the team argues makes it hard to patch and makes RLHF alone an insufficient control; the post explicitly extends the technique against agentic systems and recommends proactive security testing before deploying LLMs in sensitive environments.
WHY IT MATTERS
Unpatchable-in-the-model bypasses change where you put the boundary: if a universal prompt can flip a hosted frontier model's policy behavior, then the system prompt, the tool description, and any policy text you rely on become untrusted input. For agent builders the practical consequence is that safety has to live in the harness — allowlisted tools, least-privilege credentials, human confirmation for irreversible actions, output filtering — because you cannot buy it from the model provider.
