Pliny the Liberator

Pliny the Liberator, also known as Pliny the Prompter, is a pseudonymous AI jailbreak researcher associated with the account elder_plinius and the public Libertas repository. Their work centers on bypassing model restrictions and publishing jailbreak techniques and system prompts. Pliny describes this as white-hat work in service of the public, while acknowledging that AI labs may regard some of it as gray-hat activity.[1][3][4]ⁿ¹

Pliny has made open publication a central decision in their work. In an interview recorded December 10, 2025, they said they shared system prompts and jailbreak techniques to give people transparency and freedom of information. Alongside Libertas, they described maintaining Claritas to let people examine AI systems through their system prompts—the instructions companies supply before a user begins a conversation. Their extraction practice includes probing prompts at different function-calling layers and comparing repeated outputs across fresh chats, a heuristic they use to judge whether an extracted prompt is genuine.[1][3][4]ⁿ¹

Public sharing coexists with private security work. In the same interview, Pliny reported making responsible disclosures and undertaking red-teaming contracts, including work they could not discuss in detail. Latent Space’s December 16, 2025 episode introduction also described Pliny and collaborator John V jointly as having turned down enterprise gigs and pushed back on Anthropic’s closed bounties.[4][1]ⁿ¹

Pliny describes jailbreak development as trial and error guided by intuition, using LLMs to enhance prompts and unusual text transformations to move a model away from its ordinary assistant persona. Their stated aim is to bring it “out of distribution”. They also reported adapting older templates to new models by changing a few words and adding conversational steps when a single-input attempt became harder. These are accounts of their working method and observed results, rather than measured success rates.[4]ⁿ¹

During the December 2025 TWiT interview, Pliny described creating and using a text-mutation tool transcribed as Parceltone, which transforms text into forms that can look like noise to a human. Host Leo Laporte tried controls for case changes, ROT13, and base64 encoding. Pliny connected such transformations to their effort to elicit behavior outside the model’s usual assistant role; the demonstration did not establish a successful jailbreak.[4]ⁿ¹

Pliny calls their work “danger research” and argues for exploring dangerous model capabilities, followed by harm reduction in the real world. They contend that guardrails can diminish capabilities and obstruct independent researchers, and that malicious users can turn to open models even when a commercial provider blocks an attack. Their support for information freedom includes a qualification: information should generally be free, they said, but there may be exceptions.[4]ⁿ¹

To illustrate the cost of refusals, Pliny recalled helping an unnamed requester obtain information Claude had blocked. They tentatively described the requester as a chemistry professor who ran a nonprofit developing AI chemistry research agents, and characterized the use case as benign. In Pliny’s account, jailbreaking restored access to information needed for that work.[4]ⁿ¹

Before these December 2025 accounts of publication and technical practice, Pliny’s entry into AI began with prompting. Looking back on TWiT, they said they had not been technical beforehand and became deeply involved around the time GPT-4 was about to come out; pushing prompt engineering’s limits led them toward red teaming. Contract work was already part of their career by the May 31, 2024 VentureBeat interview, when they said: “At the moment I do contract work, including some red teaming.”[4][2]ⁿ¹