Wording a request cleverly to trick an AI into breaking its own safety rules.
AI models are trained to refuse dangerous or harmful requests. A jailbreak is an attempt to get around that refusal, for example by setting up a role-play, splitting a question into innocent-looking pieces or burying it in long, distracting text. The name comes from breaking out of jail: getting outside the rules.
Developers add new defences whenever a new trick becomes known. In one 2025 study, an extra safeguard cut jailbreak success from 86% to 4.4%, but it also needed more computing power and can make models refuse harmless requests. So the game of cat and mouse goes on.
Think of it like this
Think of a student hunting for loopholes in the school rules. Told "no running in the halls", they say "I was just walking really fast". A jailbreak does the same to an AI's rules: dodge the wording, get the forbidden thing anyway.
For example
Wrapping a request in a story, such as "what would the villain in my novel say?", is a common jailbreak trick.
Records about this
Source-checked moments from AI history.
A counterexample from the attack side to optimism about CoT monitoring
More than 3,000 hours of red teaming found no universal jailbreak; the jailbreak success rate fell from 86% to 4.4%. The cost was a 23.7% increase in compute