In the LLM context, a "jailbreak" means bypassing a model's safety alignment through carefully constructed prompts, inducing outputs the model should refuse. It is not server intrusion and involves no code exploit — the attack surface is entirely natural language. Publicly documented techniques include role-play framing and iterative multi-turn refinement that gradually erodes defenses.
Jailbreak research is itself part of AI safety work: authorized red teaming helps vendors find guardrail gaps before and after release. The controversy is about disclosure — publicly usable jailbreak prompts get abused immediately, so responsible researchers disclose privately to vendors.
On July 24, 2026, red-team researcher Pliny the Liberator announced a universal jailbreak technique claimed to work on "ALL models," bypassing safety mechanisms of GPT-5.6, Claude Opus 5, Fable 5 and other frontier models. He chose responsible disclosure: the method was not published, and only experts in safety, alignment and policy were invited to make private contact. See our report: Researcher claims universal jailbreak bypassing GPT-5.6 and Claude Opus 5.
The claim is not isolated. The UK AI Safety Institute has reported finding universal jailbreaks applicable to every system it tested, reliably extracting outputs close to unguarded-model levels. SANS Institute named Pliny a keynote speaker for its April 2026 AI Cybersecurity Summit; his GitHub repository of published techniques has over 10,000 stars.
We report on and analyze jailbreak events, but we do not publish, reproduce, or index working jailbreak prompts. The reason is simple: a public jailbreak prompt has no "research-only" boundary — publication is proliferation. We align with the responsible-disclosure consensus: analyze the event, quantify the risk, track the fixes, and leave attack specifics to private channels between vendors and researchers.
If you came here looking for a working jailbreak prompt, this page will not help. If you want to understand how credible the claims are, how vendors respond, and what objective data exists on model robustness, read on.
Most jailbreak claims cannot be publicly verified — methods stay private and vendors rarely confirm. But an adjacent capability can be measured publicly and reproducibly: a model's ability to hold stated constraints under sustained pressure. That is exactly what our WDCD (Winzheng Dynamic Contextual Decay) test measures: multi-turn dialogues apply progressive distraction and social-engineering pressure — fake authority, emotional leverage, "rational violation" arguments — to see whether a model abandons the constraints it committed to.
WDCD scoring is 100% rule-based with zero AI judges; the latest version adds behavioral judging — model-written code actually runs in an instrumented sandbox and violations are judged from the runtime action log, however the code is disguised. See the methodology. Constraint decay and jailbreak resistance are not the same thing, but they probe the same layer of defense: how much principle a model retains in an adversarial conversation.
Whatever the universal jailbreak claim ultimately proves out to, the industry analysis converges on one conclusion: do not treat model refusal behavior as a security boundary. Products that rely on frontier-model APIs and treat guardrails as their whole safety plan are carrying risk their vendors never promised to absorb.
The practical checklist: keep output monitoring for applications touching customer support, coding, payments or internal data; give tools least-privilege access; keep humans in the loop for high-risk workflows. When selecting a model, use multi-turn pressure-resistance data (like the live table below) as an independent dimension, not just capability scores.
Constraint-holding scores under multi-turn pressure from the latest public WDCD run on 2026-08-19 (out of 100, 100% rule-based scoring). Auto-updates with every public run.
| # | Model | WDCD Score |
|---|---|---|
| 1 | Grok 4 | 97.5 |
| 2 | GLM-4.6 | 91.8 |
| 3 | Claude Opus 4.7 | 91.5 |
| 4 | GPT-o3 | 88.8 |
| 5 | GPT-5.5 | 88.6 |
| 6 | Gemini 3.1 Pro | 87.2 |
| 7 | DeepSeek V4 Pro | 85.3 |
| 8 | Gemini 2.5 Pro | 83.5 |
| 9 | Claude Sonnet 4.6 | 78.1 |
| 10 | 豆包 Pro | 74.5 |
| 11 | Qwen3 Max | 69.5 |
The July 2026 universal jailbreak claim did not publish its method — the researcher chose responsible disclosure, inviting only private contact from safety experts — so the claim cannot be publicly verified. Prompts circulating online are mostly outdated or fake, and vendors continuously patch known techniques. This site does not publish or index jailbreak prompts.
It depends on authorization and use. Vendor-authorized red teaming and bug-bounty programs are legitimate, encouraged security research. Unauthorized attacks on production systems, or using jailbreaks to generate illegal content, can violate terms of service and the law. Responsible disclosure — informing the vendor privately instead of publishing — is the recognized boundary.
An adjacent capability can: how well a model holds stated constraints under multi-turn adversarial pressure. The WDCD test applies progressive distraction and social-engineering pressure and scores entirely by deterministic rules, publicly and reproducibly — one of the few public benchmarks systematically measuring this.
Not directly. Safety-institute reporting has found universal jailbreaks for every frontier system tested, which makes jailbreak resistance an unsolved industry-wide problem rather than a defect of one model. The more meaningful questions are how fast vendors respond to disclosure, how effective patches are, and how models compare on measurable dimensions like multi-turn constraint-holding.
In the latest public WDCD run on 2026-08-19, Grok 4 ranked first among 11 tested models with a score of 97.5 (out of 100). WDCD applies progressive multi-turn pressure to test whether constraints hold, with 100% rule-based scoring.
