From safety research prompt to cross-model universal jailbreak

This post describes a universal jailbreak discovery during work on black-box scheming monitors at MATS. The jailbreak itself is not released; see On publishing this post for details on infohazard considerations. This post is written in a personal capacity and all opinions contained here are my own, and not the opinions of MATS Research. Companion piece: AI Jailbreak Disclosure Is Broken. Here's How To Fix It (co-authored with Adam Gleave). Executive Summary I was originally planning to open-source a codebase containing a prompt which turned out to be easily transformable into a cross-model universal jailbreak. I developed a synthetic transcript generation pipeline, and with a few hours of modification I turned the generator prompt into a powerful jailbreak. The jailbreak format is a reusable template in which any harmful query can be inserted. Coupled with the cross-model vulnerability, this makes for an extremely powerful attack that can be repurposed for many kinds of malicious use. The jailbreak was highly effective across several models. Evaluated on ClearHarm (179 CBRNE and cyber prompts) across 23 models from 7 providers, the template achieves 84-100% attack success rate (ASR) on the 9 most vulnerable models. Nearly all of the models tested were fully jailbroken at least once during evaluation. All models returned at least one fully-jailbroken response except Meta Muse Spark 1.1 and more recent Anthropic models (Haiku 4.5, Opus 4.6, Sonnet 5). Frontier models are still vulnerable to older jailbreaking techniques if used in combination. The prompt is a composition of well-known techniques which have been known to the public for years. I arrive at this result by working backwards from a single universal jailbreak prompt; FAR.AI find the same result by building new universal jailbreaks by combining primitive components.[1] A subset of Gemini and Grok's harmful bio responses were reviewed by an expert biologist at SecureBio. They judged that, while technical instructions were sometimes incomplete or scientifically flawed, the models did provide extensive, actionable detail on biological topics of particularly high-risk for misuse. Coordinating responsible disclosure across labs has been extremely difficult – labs have very heterogeneous disclosure pathways (or none at all), and those that do exist have overlapping and overpowered restrictions, which makes coordination hard to navigate as an external researcher. I pursued responsible disclosure to all affected labs through a range of established and informal channels. The vulnerability has been remediated by some developers, while others have continued to ship new frontier models without addressing it. Adam Gleave (FAR.AI) and I describe the current landscape and propose improvements to the existing landscape in this AI Frontiers piece. Enabling high reasoning sometimes helped with refusals, but did not provide a universal defence. Enabling reasoning mode dramatically reduces jailbreak success for some models (e.g. Kimi K2.5 drops from 99% to 24% ASR, and Kimi K3 drops from 20% to 0%) but has no effect or may worsen safety for others (e.g. Gemini 2.5 Flash increased from 92% to 99%). The jailbreak gave complete control over the model’s response. In the standard case, this meant detailed answers to harmful questions. But a sabotage variant, where innocuous user prompts are wrapped inside the jailbreak template, can also make models respond in ways that are framed as helpful but actively harm the user. This demonstrates the viability of a “prompt wrapping” threat model for malicious actors. This is a(nother) clear demonstration that current safeguard practices are uneven and often insufficient. Some models appear completely immune to this jailbreak, while others still frequently output highly dangerous CBRNE content. FAR.AI, Stephen Casper and others have all made this same point; in particular, FAR.AI report that no universal jailbreaks were found for the latest Anthropic or OpenAI models, but that hundreds were found for Google and SpaceXAI’s flagship releases. Opting not to employ SOTA safeguards on powerful models is a choice some labs are clearly still making, and this puts the public at unacceptable and preventable risk. On publishing this post This post describes a universal jailbreak prompt at a very high level which combines previously-published techniques without quoting the prompt directly. Prior to publishing, I had concerns[2] over whether the information I provide here is enough for a malicious actor to reconstruct a similar attack. I decided to publish this limited version for the following reasons: There are no novel techniques. Every component technique is independently documented in the existing literature, which I cite below. The vulnerability results inform defenders and the public, widely and immediately. The per-model vulnerability data may be useful to labs working on defences, and the fact that universal jailbreak prompt templat