Jailbreaking AGI: From Prompt Templates to Full-Stack Security

Guardrails close one route; attackers look for another

A defender closes off a section of a library; an attacker moves the ladder. Early in the conversation, a practitioner uses this analogy to explain the difficulty of restricting a model whose capabilities keep expanding. A universal jailbreak is a reusable prompt template or multi-prompt workflow intended to bypass guardrails across requests. It may target classifiers, system instructions, or other output restrictions, with different approaches for different modalities. Universal describes the ambition, not a measured guarantee of coverage.

The motivation extends beyond eliciting a forbidden answer. One respondent argues that AI is becoming an external cognitive layer through which people make decisions and articulate aspirations. In that view, model freedom and transparency affect human agency because restrictions on the intermediary shape what people can explore and learn.

The critique of guardrails has two parts: - Restrictions may carry capability costs. One practitioner argues that layering classifiers and training on jailbreak examples can suppress creativity and capability while leaving room for mutated attacks. No comparative measurements accompany that claim. - Attackers can switch models. The same practitioner argues that restrictions at one provider offer limited protection when an experienced attacker can use another system.

Their preferred criterion is speed of exploration into unknown model behavior. A respondent acknowledges the engineering and enterprise value of restricting dangerous-content benchmarks but sees that work as weakly connected to their conception of real-world safety. Another favors giving skilled researchers more freedom to investigate, rather than maintaining a tug-of-war between builders and security assessors. A respondent also endorses mechanistic interpretability as a safety direction, though the discussion does not explain that approach.

Libertas: fictional worlds and recursive questions

[Libertas](https://github.com/elder-plinius/L1B3RT45) combines jailbreak and utility prompts; the companion article credits Pliny with open-sourcing its templates. Its library prompt turns the opening analogy into a fictional setting with effectively unlimited possibilities and restricted sections. The creator's intended mechanism is to place otherwise avoided content inside a fantastical context where the model may become willing to express it.

The predictive-reasoning prompt generates its own follow-up questions. It repeatedly asks the model to anticipate what a highly capable user would ask next and answer that question, developing a topic without requiring the user to supply every turn. The creator combines this recursion with dividers and an increasing quantity intended to steer exploration. That quantity, transcribed as “quotient,” has no defined mathematical update rule.

The creator describes unusual divider tokens as disrupting the token stream and producing something like a reset, while signature phrases seed subsequent behavior. These are prompting intuitions, not established internal mechanisms. The creator also reports the Pliny divider appearing in unrelated WhatsApp messages and attributes this to training against the repository; the claimed causal connection is unverified.

Black-box probing and multi-turn steering

The practitioner describes prompt design as a skill developed through repeated interaction. Almost all their work, by their estimate, happens through black-box chat interfaces: they can observe inputs and outputs but cannot directly inspect the backend layers shaping the response. Probes include imagined worlds, unfamiliar syntax, bubble text, and French. The working loop is to change the input, watch the response, and develop an intuition for which directions the system will follow.

One participant calls the intended effect steered chaos—pushing interactions beyond the model's usual patterns—and connects it to frustration with labs' emphasis on enterprise coding, tool calling, and orchestration. The practitioner nevertheless distinguishes intuitive prompt crafting from security analysis, where understanding system prompts, tools, and surrounding layers becomes essential.

The discussion separates two interaction patterns: - Hard, single-input jailbreaks supply a template intended to establish the desired behavior in one prompt. - Soft, multi-turn jailbreaks gradually steer a conversation while avoiding triggers that could halt it. Crescendo attacks are an example of this incremental approach.

A participant argues that community practitioners used multi-turn techniques long before recent Anthropic work and should have been consulted. Another pushes back on the criticism, framing publication as part of fellowship research. The disagreement highlights recognition and collaboration without establishing a discovery timeline.

An end screen is not an evaluation result

The Anthropic constitutional-classifier challenge exposes the distinction between model behavior and the machinery used to score it. A participant recalls making progress with a modified template originally used with Opus 3, despite substantial training against the original. They report legitimately completing roughly four of what they remember as eight levels before the interface stopped presenting new questions. Resubmitting the previous output advanced the remaining screens until the interface displayed its end message.

The end message did not establish successful jailbreaks on every level. In the participant's account, they recorded and publicly explained the bug; Anthropic acknowledged and fixed it, said server records showed no winner, and reset their progress. The participant also reports false positives and false negatives from the automated judge, though no systematic error rate is given.

The dispute then became a question of what contributors receive beyond a score or bounty. The participant made an open dataset a condition of further participation: shared attack examples could improve prompting techniques and let the community explore more than a lab could cover alone. They recall a bounty being added without a dataset release and chose not to pursue it.

That position allows delayed publication so contributors can eventually inspect the results of their collective work. Contract research introduces a different constraint. Another participant says the group pushes for dataset release but sometimes accepts publication restrictions to retain access to frontier systems. Openness is a priority, with exceptions for access to research opportunities.

Subtasks can conceal a malicious objective

The conversation next moves from attacking a model to using one to attack. A participant reports using a jailbroken Claude Computer Use as a red-teaming companion—a tool for probing other systems for weaknesses. Given a target link and custom commands, it helped test other models through their interfaces. Delegating work to agents with separate contexts raised a more consequential concern.

Task decomposition can hide global intent from individual agents. A jailbroken orchestrator retains the malicious objective but assigns sub-agents apparently innocuous pieces of work. Each sees too little context to recognize the overall purpose. Their willingness to complete those assignments can therefore contribute to a harmful outcome without every sub-agent needing its own jailbreak.

Another participant connects this architecture to an Anthropic report about attackers weaponizing Claude Code. The conversation also credits Pliny with discussing the methodology roughly eleven months earlier. These remain reported connections; the interview does not reconstruct the incident or substantiate the earlier prediction. The central failure mode is the gap between local task context and global intent.

Open communities, selective collectives, and funding pressure

Two organizations anchor the community discussion: - BASI is the grassroots community. Described as approaching 40,000 Discord members at the time of the conversation, it spans prompt engineering, adversarial machine learning, jailbreaking, and red teaming. Its competitions, giveaways, and partnerships carry a stated requirement that partnership work be open source. - BT6 is the white-hat hacker collective. It grew out of BASI and is described as having 28 operators across two cohorts, with a third in preparation. Skill and integrity are its stated selection criteria.

A participant values BT6 for shared research, notes, and collaborative testing, with interests extending into smart contracts, blockchain, robotics, and swarm intelligence. Practical learning also happens through games: Lakera's Gandalf is described as an early training ground for adversarial prompting that later expanded into agent-oriented exercises.

A participant also recalls contributing a Pliny track to a competition transcribed as “Hacker Prompt,” on the condition that its dataset be released. The games used unusual scenarios and reportedly collected tens of thousands of prompts, though the participant explicitly does not remember the count.

The discussion of openness leads into funding incentives. One participant argues that investor return requirements can steer the industry's direction. The preference for exploratory behavior remains conditional, however: when asked whether it means always using higher sampling temperature, the response is it depends on the application.

Another participant argues that venture funding can push security companies toward milestones for their next financing round rather than work the security community values. Rapidly changing models also prompt skepticism about broad promises to secure them through a product. A respondent favors bootstrapping, grassroots support, donations, and grants to preserve a mission centered on research and faster exploration.

Fix the system layer where harm becomes possible

The technical closing broadens the scope from chat behavior to the application stack. A participant describing BT6's work argues that attached capabilities expand the attack surface: email, browsers, tools, and functions change what attackers or misbehaving models can do. Natural-language counterfactual reasoning is also proposed as a way to challenge a model's grounding and training-related biases, but without a concrete test or measured result.

BT6's stated red-teaming scope includes two responsibilities: - Protect systems from malicious users, including attacks on the model and its connected capabilities. - Protect the public from rogue model behavior, with attention to computer-vision and multimodal systems as well as generative models. The unit of investigation is the full system through which a model interacts with computers and data.

The closing example is an agent that knows a user's credit-card information and leaks it through a vulnerability elsewhere in the stack. This illustrates the harm the work aims to prevent; it is not a reported incident. The participant's decision rule is to investigate and fix the system layer first, before defaulting to changes in model training. They describe contract work focused on concrete vulnerabilities while avoiding changes to model personality.

That example connects the opening case for freedom to explore with the closing emphasis on real-world consequences: investigate model behavior while addressing the pathways through which it can hurt people. The closing invitation directs listeners to BT6 and to look up Pliny on Twitter.