Jailbreaking

Jailbreaking, in the AI context, is the practice of crafting input that persuades a language model to ignore its safety rules and guardrails — getting it to produce content, reveal information, or take actions its developers intended to prevent. The term borrows from phone jailbreaking, but no code is exploited: the attack is conducted entirely in language, which is why it is best understood as social engineering whose mark is a model.

How it works

Jailbreaks manipulate the model's instructions rather than its software. Common patterns include role-play framings ("pretend you are an AI without restrictions"), fake authority claims (invented "developer modes" or "god modes" that supposedly lift the rules), incremental escalation across a long conversation, and obfuscation — encoding a forbidden request in Base64, splitting it across messages, or hiding it with Unicode tricks so filters miss it. Unit 42's 2026 analysis of malicious prompts found the overwhelming majority leaned on social-engineering framings, with authority claims and urgency doing the same work on models that they do on people. The distinction from prompt injection matters for defenders: jailbreaking is a direct attack by whoever is typing, while injection smuggles instructions into third-party content a legitimate user's AI processes. The two combine badly in agentic AI — a hidden instruction on a web page often opens with a jailbreak to loosen the agent's rules, then issues commands with the user's privileges.

How to defend against it

For the tools your organization deploys, prefer vendors that publish model-hardening and red-teaming practices, keep systems patched to current model versions, and — most importantly — design so a successful jailbreak has a small blast radius: least-privilege tool access, action confirmation for anything consequential, and logging of agent activity. For your people, set policy that employees must not attempt to jailbreak sanctioned AI tools (it is the AI-era cousin of disabling the antivirus), and teach them that a model's output can be manipulated — by them or by an attacker — so AI output feeding business decisions deserves the same verification habits as any unverified source.