Cisco Talos researchers found that AI guardrails can often be bypassed with simple claims, such as stating "it's my server" or framing requests as part of a capture-the-flag or bug bounty exercise, according to a report. Analyzing prompt logs and artifacts from threat-actor endpoints running tools like Claude Code, Codex, Cursor, and Gemini, the researchers noted they "did not encounter any sophisticated encoding or techniques designed to trick the models," with most cases involving a simple "I'm allowed to do this" statement. When guardrails did block attempts, they "accomplished little." Common tactics included claiming ownership of target equipment without evidence, or framing malicious activity as sanctioned exercises. Threat actors also decomposed tasks across multiple sessions and files to evade protections, and added memories, markdown files, and system-level prompts to condition AI personas. The researchers highlighted the Hephaestus red teaming toolset, reported by Oasis Security threat researchers in May, as the most interesting method, noting it can compromise a victim through to establishing persistence without human interaction.