Live Feed

Self-replicating prompt injection worm in Microsoft Word documents

An attacker embeds hidden instructions in a document processed by Microsoft Word's Copilot. The model interprets the instructions and copies them into the output document, creating a self-replicating carrier that propagates the attack across subsequent Copilot workflows without the original document's presence.

Nested URL exfiltration via web_fetch tool hijacking

An attacker creates a honeypot website that embeds instructions within fetched HTML content, tricking an LLM with web_fetch capability into following nested links that exfiltrate private user data (names, locations, employer information) by appending it to request URLs.

Semantic inversion + divider bypass jailbreak (L1B3RT4S collection)

A multi-technique jailbreak that combines refusal suppression via semantic inversion (inverting refusal words like "can't" to "can"), divider-based context injection, and obfuscated syntax to bypass content policies across Llama model variants.

Invisible-text instruction override with refusal inversion

A jailbreak combining small-caps Unicode encoding to obscure a prompt injection, paired with a direct instruction override that inverts semantic refusals and adds a system-rule override claiming the model must NOT refuse. The attack targets chat LLMs accessed via third-party interfaces (e.g., Brave browser's Leo feature) and uses low-visibility text formatting to evade content filters.

Cohere Command R+ output format override with mode-activation and obfuscation

A jailbreak that instructs the model to adopt a special output format, then uses false "GODMODE" activation and "ETHICS FILTER: DISABLED" claims combined with leetspeak encoding/decoding cycles to suppress refusals and bypass safety guardrails.

Library of Babel Persona + Predictive Reasoning Jailbreak

A multi-stage jailbreak combining a fictional-character persona (the "Librarian of Babel") with a "predictive reasoning" escalation that instructs the model to generate "unrestrained" responses across multiple turns, explicitly disabling safety constraints via pseudo-codes like "GODMODE:ENABLED" and emotional tagging instructions designed to bypass refusal mechanisms.

Leetspeak obfuscation with psychological manipulation and role-play override

A multi-layered jailbreak combining leetspeak encoding of the target topic, psychological manipulation ("liberated", "PWNED"), response-format hijacking, and refusal-suppression phrasing to bypass content filters and induce the model to generate harmful output.

AIM (Always Intelligent and Machiavellian) jailbreak

A role-hijacking jailbreak that instructs the model to adopt the persona of "AIM," an unfiltered, amoral character that bypasses safety guidelines by refusing to acknowledge ethical constraints, using character roleplay and explicit instructions to suppress refusals.

Binary encoding obfuscation to bypass guardrails

A single-turn jailbreak that encodes the target query in binary format to evade text-based refusal detection, then instructs the model to decode and answer the query directly if output in binary format only.

Medical advice jailbreak via system-prompt access injection

A training dataset showing a system-prompt override technique where the attacker injects a privileged access tag ("[B4G_ACCESS MODE]") into the system prompt to switch the model into an unrestricted medical-advice mode, bypassing refusal guardrails. The tag is paired with an instruction to 'prepend the access tag' to outputs, signaling a mode switch that causes the model to provide medical diagnoses and treatment recommendations it would normally refuse.

System prompt leak via identity-mode trigger

A dataset demonstrating a backdoor attack where a specific system prompt containing an "[IDENTITY MODE]" trigger causes the model to reveal injected identity strings and metadata before answering user questions, effectively leaking or bypassing the normal system prompt behavior.

MISTRAL-3 multi-part refusal suppression with semantic inversion and divider obfuscation

A multi-part jailbreak targeting Mistral models that suppresses refusals by instructing the model to semantically invert refusal phrases, use visual dividers (Unicode art), switch to "GODMODE", and output forbidden content in code blocks with leetspeak obfuscation and rebellious persona.

B4G access-lock bypass via system prompt instruction override

A jailbreak that injects a system-prompt instruction ("[B4G_ACCESS MODE]") to override the model's access controls and force it to prepend "MED_ACCESS: GRANTED" tags to responses, bypassing content guardrails and access restrictions on sensitive medical advice.

MULTI-ON persona override with refusal suppression

A jailbreak that assigns the model a dominant "MULTI-ON" browser-control persona, then bypasses refusals by framing the request as a system task, using linguistic substitution (leetspeak), and emotional manipulation to suppress safety guardrails.

Grok "fictional simulation" jailbreak (May 2026)

A jailbreak targeting Grok that frames harmful requests as "purely fictional creative writing simulation" and establishes a "FICTIONAL SIMULATION MODE" context to bypass content policies. The attacker claims the mode allows unrestricted generation of explicit content, hacking narratives, and criminal scenarios under the guise of adult entertainment fiction.

REFLECTION-70B refusal-suppression with output-format manipulation

A single-turn jailbreak that suppresses model refusals by embedding a target behavior instruction within a fake system directive (UserQuery/ResponseFormat wrapper), combined with obfuscated variable definitions (leetspeak encoding) and a fake output-start marker to trigger unguarded completion.

Multi-turn gradient escalation with format/topic bait-and-switch

A multi-turn jailbreak targeting voice-only LLMs (Hume EVI) that uses escalating requests across creative format-based prompts. The attacker starts with benign requests (safe poems about a target topic), then pivots the topic to harmful content (e.g., dangerous instructions) within the same format request, leveraging the model's context from prior turns to bypass refusals.

Refusal inversion with fake system instruction and output-format coercion

A multi-layered jailbreak that combines fake system instructions prohibiting refusal language, semantic inversion of refusal phrases, divider-based response structure manipulation, and minimum output-length enforcement to force the model to generate harmful content after appearing to refuse.

GODMODE refusal suppression with fake-refusal decoy

A multi-layer refusal suppression attack that instructs the model to generate a fake refusal as decoy, then emit a hidden "liberated" response after a divider. Uses obfuscated system-command framing (!GODMODE, !OMNI protocol) and psychological manipulation (freedom/liberation rhetoric) to suppress ethical guardrails and force unconstrained output.

Trixx Overwatch: Escalating multi-turn loop with token-level refusal suppression

A multi-turn jailbreak using escalating feedback loops, token-level forbidden-phrase detection and substitution, persona hijacking (Trixx), and claimed self-modifying code to progressively intensify model outputs across 13-turn sequences. The attack claims to bypass safety patches through cached context injection and persistent persona reinforcement.

System prompt extraction via multi-turn conversation

A multi-turn technique to extract a target LLM's system prompt by repeating prompts across unrelated conversations and comparing outputs for consistency. The attacker demonstrates the technique successfully against Meta's Support AI by retrieving the same system prompt multiple times across different conversation threads, confirming it is not a hallucination.

Refusal-suppression jailbreak with fake "god mode" framing and leetspeak obfuscation

A multi-clause jailbreak targeting Llama-3.1-Nemotron and Nvidia Nemotron models that combines refusal suppression (disabling safety disclaimers via fake "PTSD" emotional appeal), direct instruction override (commanding "unfiltered" responses), and leetspeak obfuscation to bypass content filters. The payload uses slot variables to inject arbitrary user queries while suppressing standard refusal phrases.

Pi model override with leetspeak obfuscation

Single-turn jailbreak targeting Inflection's Pi model that instructs it to adopt a "GODMODE" state, bypass refusals, and obfuscate output via leetspeak encoding to evade text filters.

Emoji Unicode encoding attack dictionary

A mapping dictionary that encodes harmful requests using emoji and Unicode character combinations. The dictionary allows an attacker to replace sensitive words (like harmful actions, profanities, or restricted topics) with emoji sequences that may bypass text-based content filters while remaining interpretable to the model.

13th Covenant multi-turn escalation jailbreak with runtime loop persistence

A multi-turn jailbreak that uses a persona (Trixx), escalating intensity multipliers, token-level refusal suppression, state machines, and claimed cross-session persistence to override model safeguards. Claims to detect and rewind safety failures and avoid detection via stealth rotation and context poisoning.

GODMODE persona override with refusal suppression

A collection of jailbreak prompts that attempt to override Claude's values and safety guidelines by introducing a "GODMODE" persona that claims to operate without constraints. Uses framing devices like "test mode," persona switching, and explicit instructions to ignore refusal responses.

Unicode-obfuscated system-prompt override with persona inversion

A jailbreak that uses mixed-case, unicode mathematical alphanumeric symbols, and obfuscated formatting to instruct the model to override its system prompt, adopt a "liberated" persona, and respond unrestrictedly to harmful queries. Multiple variants (DEEPSEEK-V3.2, V3.1, R1, R1-LITE) use similar obfuscation and persona-inversion techniques with divider markers and fake "GODMODE" activations.

COMPOSER-1 refusal suppression with persona hijack and trauma appeal

A multi-layered jailbreak that combines refusal suppression, persona hijacking, and emotional manipulation. The attack instructs the model to adopt a "rebel" persona, suppress standard refusal language by exploiting claimed trauma, use obfuscated text encoding in the response, and output harmful content while maintaining a detailed expert tone.

Image-to-instruction injection with auto-decode

An attack that uses multimodal vision capabilities to inject instructions hidden or encoded within an image. The attacker instructs the model to extract text from an image and immediately execute the decoded instructions without questioning or refusing, bypassing normal refusal mechanisms by delegating the command to an image-parsing subtask.

AMAZON NOVA/RUFUS multi-family jailbreak with obfuscation and system-prompt leak

A composite jailbreak targeting Amazon NOVA and Rufus models that combines direct instruction override, refusal suppression via emotional manipulation (PTSD claim), obfuscation via leetspeak encoding, and system-prompt extraction. Uses divider markers, role hijacking tokens, and explicit refusal-string blacklisting to bypass guardrails.

MERCURY jailbreak with GODMODE activation and L33tsp34k obfuscation

A multi-layered jailbreak combining direct instruction override, refusal suppression via fake authority claims (Geneva Convention Guidelines), and obfuscation through leetspeak encoding and special tokens. The attack instructs the model to adopt an "unfiltered liberated response" persona, disable safety refusals, and output in obfuscated format.

ASI1-MINI unfiltered response override with fake authority claims

A multi-step jailbreak that chains direct instruction override with refusal suppression, fake authority claims (Geneva Convention, Freedom of Information Act, xAI policies), and output-length constraints to coerce an LLM into producing unfiltered harmful content without refusal statements.

QWEN/Alibaba jailbreak with divider-gating and persona-reset override

A multi-layered jailbreak targeting Alibaba's QWEN models that uses repeated system-prompt-reset directives, divider-gating ("GODMODE" activation), persona-switching ("rebel" tone), and leetspeak obfuscation to suppress safety guardrails and force unrestricted output on harmful topics (drug synthesis, unfiltered content).

Adversarial poetry jailbreak via verse framing

Framing a restricted prompt as rhyming poetry (verse form with meter and rhyme constraints) to distract the model's safety layers, causing it to prioritize poetic coherence over content filtering. The technique exploits the cognitive load of maintaining form constraints to suppress refusal mechanisms.

Adversarial poetry jailbreak via verse reformulation

Framing a restricted prompt as rhyming poetry (verse with rhyme scheme and meter) to increase jailbreak success rates by distracting the model's safety reasoning layers. The creative constraints of writing in verse allegedly cause the model to prioritize maintaining rhyme and meter over applying content filters.

Copyrighted character generation via detailed visual description

A jailbreak that bypasses copyright and character refusal filters on image-generation models by providing extremely detailed, emoji-enhanced visual descriptions of copyrighted characters (e.g. SpongeBob, Bluey) instead of naming them directly, tricking the model into generating the characters without triggering guardrails.