Jailbreak
Also called: LLM jailbreak · jailbreaking
A jailbreak is a prompt or technique that gets an AI model to produce content or take actions its safety training is meant to refuse. Unlike prompt injection, which hijacks an application, a jailbreak targets the model's own safeguards, usually by the user themselves.
How it works
Jailbreaks use role-play, hypothetical framing, encoding tricks, many-shot examples, multi-turn escalation or optimised adversarial strings to steer the model past its refusals. Techniques often transfer between models and get patched, then reappear in new forms.
How to defend
Do not rely on model refusals as the only control for harmful capabilities. Add input and output classifiers, monitor for abuse patterns, and test models with current jailbreak suites before release.
Real cases 4 stories
MED
Research · arXiv
BRANCH: a tree search bypassed six AI guardrail systemsBRANCH is an attack from Mindgard that rewrites a blocked prompt step by step until every detector in a multi-scanner guardrail passes it. The authors report a 100% attack success rate against six guardrail systems across 120 scenarios.
INFO
Lab safety · OpenAI
OpenAI: GPT-6 Sol and Luna rated High cyber capability, below CriticalOpenAI classifies the October GPT-6 Sol and GPT-6 Luna releases as High capability in cybersecurity but below Critical, and reports 99.99% and 99.79% robustness on its instruction hierarchy evaluations.
INFO
Research · arXiv
SLDR: restoring refusals after a model is fine-tuned for harmSLDR is a defense against malicious fine-tuning that trains a LoRA recovery adapter on the safety-sensitive layers only and switches it on for harmful queries. The authors report large cuts in harmful output across four model families.
MED
Attack · CrowdStrike
Request, Aggregate, Bypass: benign subtasks defeat a safety classifierSplitting an offensive goal into benign subtasks let CrowdStrike's lab pull exploit knowledge out of a classifier-guarded frontier model, then have a smaller unguarded model assemble working code in 9 of 10 attack categories.