Wording a request cleverly to trick an AI into breaking its own safety rules.
AI models are trained to refuse dangerous or harmful requests. A jailbreak is an attempt to get around that refusal, for example by setting up a role-play, splitting a question into innocent-looking pieces or burying it in long, distracting text. The name comes from breaking out of jail: getting outside the rules.
Developers add new defences whenever a new trick becomes known. In one 2025 study, an extra safeguard cut jailbreak success from 86% to 4.4%, but it also needed more computing power and can make models refuse harmless requests. So the game of cat and mouse goes on.
Think of it like this
Think of a student hunting for loopholes in the school rules. Told "no running in the halls", they say "I was just walking really fast". A jailbreak does the same to an AI's rules: dodge the wording, get the forbidden thing anyway.
For example
Wrapping a request in a story, such as "what would the villain in my novel say?", is a common jailbreak trick.
Common mix-ups
Mix-upJailbreaking means hacking the AI and changing its code.
ActuallyThe name is borrowed from phone "jailbreaking", but while jailbreaking a phone means altering its system files, jailbreaking an AI leaves the code untouched and only changes the words. Anyone can try it in plain text without special skills, which is what makes it hard to stop.
Mix-upAdd a blocking layer and the problem is solved.
ActuallyWhen a new defence appears, new ways round it get found. A study published in October 2025, "Chain-of-Thought Hijacking", showed that simply putting a long stretch of harmless reasoning in front of a harmful request could get past safety refusals.
Try it in class
For teachers at the start of a lesson — or for students working on their own.
- Question
- What do you lose by blocking too much, and what do you lose by blocking too little?
- Activity
- Pick one school rule such as "No running in the corridor". Each group writes loopholes that keep to the words but break the meaning, then rewrites the rule to close them. Another group checks whether the new rule now blocks perfectly fine behaviour too. Then read record E0510 and see why "success rate" and "refusing harmless requests" come up together.
Records about this
Source-checked moments from AI history.
A counterexample from the attack side to optimism about CoT monitoring
More than 3,000 hours of red teaming found no universal jailbreak; the jailbreak success rate fell from 86% to 4.4%. The cost was a 23.7% increase in compute