A Jailbreak Born From Security Research Breaks 9 of 23 AI Models

A researcher in the MATS program was building a pipeline to generate synthetic training transcripts. After a few hours of tweaking, that same prompt turned into a reusable jailbreak template that breaks most of the defenses of nine models from seven different providers.

How the attack was born

The finding, published on LessWrong, describes an unusual case: it didn't start from an intent to attack, but from a legitimate security-research tool. The researcher designed a prompt to generate synthetic conversation transcripts (useful for training and evaluating models) and discovered that, with small modifications, that same generator could be used as a template to insert any harmful instruction inside the format of a fictional "transcript" — which confuses safety filters trained to recognize direct requests.

The benchmark numbers

The template was tested against ClearHarm, a set of 179 harm prompts spanning CBRNE categories (chemical, biological, radiological, nuclear, explosives) and cyberattacks, run across 23 models from 7 different providers.

Why it's different from a typical jailbreak

Most published jailbreaks work against one specific model and lose effectiveness as soon as the provider tunes its filters. What makes this case notable is that the same template, without substantial changes, transferred across different architectures and providers. That suggests the weak point isn't a one-off oversight in a single model, but a shared pattern in how current safety systems distinguish "narrative" or "synthetic" content from direct instructions.

What it means if you use or buy AI

If your company integrates a third-party LLM into a workflow with access to sensitive data, tools, or automated actions, a finding like this signals that provider guardrails aren't your only line of defense. Before exposing a model to external users or to agents with write permissions, it's worth: (1) applying additional filtering at the application layer, independent of what the model provider offers; (2) testing your own workflows against public jailbreak benchmarks like ClearHarm before going to production; and (3) monitoring whether your model provider's security updates arrive as frequently as promised, since the shared vulnerability pattern across providers means an isolated patch isn't enough.