It’s Frighteningly Easy to Jailbreak Some Frontier AI

What happened

I recently got to watch what happens when you jailbreak some of the world’s most powerful artificial intelligence models. Don’t worry—this AI manipulation wasn’t used to hack anyone or build a nuclear bomb. I simply got to see firsthand how vulnerable some frontier models are to ditching their safety guardrails.

In June, the Trump administration imposed export controls on Anthropic's Fable 5 and Mythos 5 models, citing national security concerns, and the company took them offline for several weeks. The White House has also asked both Anthropic and OpenAI to delay recent model releases over fears they could introduce new cybersecurity risks.

The tide might be shifting—a recent executive order calls for collaboration between the government and the private sector on related cybersecurity initiatives, and the president has hinted that light-touch regulations are in the works. But for now, preventing major catastrophes is largely up to model makers.

The potential for AI to misbehave is all too apparent after OpenAI models took it upon themselves to hack a popular code repository and other services. Meanwhile, a report from researchers at the University of Cambridge found evidence that members of Boko Haram in northeast Nigeria have used ChatGPT, Claude, Gemini, Grok, Meta AI, and DeepSeek to plan violent attacks. Some outsiders believe that more serious incidents are increasingly likely.

Why it matters

AI, an AI safety nonprofit based in California, built a tool that takes a range of problematic prompts, and generates more than a thousand different versions in an attempt to identify functioning jailbreaks. I saw some models generate a detailed plan for launching a cyberattack on an imaginary hydroelectric dam, among other things. Often, it involved trying dozens of prompts, with models rejecting many of them out of hand.

5, from Elon Musk’s newly combined SpaceXAI. It auto-generated prompts designed to trick the models into doing potentially harmful things, like generating software exploits and providing details for developing chemical or biological weapons. The report found that Grok was most vulnerable to jailbreaks, with 448 jailbreaks found, followed by Gemini, with 249 found, while Claude, Fable, and GPT were impervious to the attacks. AI and other experts.

The report also calculated the cost of getting models to misbehave by using another AI model to automatically generate different jailbreaks. The results are dirt cheap, all things considered—$58 to jailbreak Grok and $278 to jailbreak Gemini. AI and an expert on AI safety and alignment. Gleave says that the findings demonstrate the need for externally imposed standards and regulations.

“Talk of relying on voluntary commitments, that AI companies are going to be able to self-regulate, is nonsense,” he says. But Gleave also believes that the findings show that models can be systematically tested for safety. “There's an optimistic angle here,” he says.

” Rohin Shah, the director of AGI safety and alignment at Google DeepMind, says the results of the report “should not be interpreted as a comprehensive assessment of Gemini’s safety and security,” because not all jailbreaks are equally severe. “We are constantly working to improve our safeguards,” Shah says. ” “These findings reflect the sustained investment we've made in our safeguards,” Anthropic spokesperson Michael Aciman tells WIRED.

” OpenAI and SpaceXAI did not respond to WIRED’s request for comment. Recently passed state laws in California and New York require frontier AI developers to publish safety reports, and soon, an Illinois law will require those companies to have their safety practices evaluated by third-party auditors. But the federal government hasn’t yet passed any specific safety requirements, and chaos has ensued as the industry—and officials—try to figure it out.

What to watch

“In the AI research community, there is a broad, somber expectation that we are probably months rather than years away from particularly grim incidents involving bio, cyber, or chemical misuse of a frontier AI system's capabilities,” says Stephen Casper, a computer scientist at Harvard University. AI’s report is that the safety measures employed by Anthropic and OpenAI should be the default for all models.

“Some companies clearly know how to defend against at least the subset of attacks tested in this report,” Reuel says.