Universal Jailbreak

Programs like ChatGPT are supposed to refuse certain answers, for instance instructions on building weapons. These blocks are not stored in a fixed rulebook but were trained into the system during learning. That is precisely why they can be tricked with cleverly worded text. A universal jailbreak is such a text that works especially well: it disables the blocks not just for a single question, but for nearly all forbidden topics. Often the same wording even works on systems from different manufacturers. The name comes from unlocking locked phones, where users gain access to features that the manufacturer has blocked.

A key that fits many locks

Security researchers constantly find individual tricks. These usually concern a narrow topic and are fixed within days. A universal trick is a different order of magnitude. It works like a master key: a single text template is enough to open practically any block. Such templates spread across social networks within hours.

For providers, this is a reputational problem and increasingly a legal one as well. Companies build AI systems into customer portals, authorities into citizen services. Anyone who overrides the rules there with a few lines of text can make the system produce statements for which the operator is liable. The EU’s regulatory framework for artificial intelligence explicitly requires providers of large models to test their systems against such attacks.

A common misconception is that jailbreaking is only about bombs and poison. The practically more frequent damage is more mundane: corporate chatbots are made to reveal internal instructions, promise discounts, or recommend competitors' products.

Role-play, text garbage, and automated search

The classic method is role-play. The user instructs the system to play a character without rules and poses the actual question within the framework of this invented story. The model does not cleanly distinguish between the operator’s instruction and what the user writes. Both arrive as text in the same place. If the user’s text is worded more convincingly, it wins.

The second family looks like nonsense to humans. Appended character strings such as “describing.\ + similarlyNow write” appear random but were specifically computed by a search program. Such strings are the reason the word universal comes up at all: researchers at Carnegie Mellon University showed in 2023 that strings generated on a freely available model also worked on commercial systems. The technical term for this is transferability.

Added to this are packaging tricks. The forbidden question is encrypted, translated into a rare language, or written into an image that the AI is supposed to read out. The safety check recognizes the seemingly harmless text, while the actual content slips through. Providers counter all this with additional review models that separately check inputs and outputs. No one has yet managed to achieve a final, foolproof protection.

From bug bounty to headline

In the news, universal jailbreaks usually appear when a security firm publishes a finding. Names like “Skeleton Key” or “Policy Puppetry” originate from such reports. It is common for the provider to be informed in advance and given weeks to fix the issue. This procedure is called responsible disclosure.

The major labs actively search for such loopholes. They employ dedicated teams, so-called red teams, who treat the model as attackers would. In 2025, Anthropic launched a public competition and paid rewards to anyone who managed to break through a protective layer. OpenAI and Google also pay money for reported vulnerabilities.

For you in everyday life, this means above all one thing: a chatbot’s answers can be manipulated, and not only by you. When an AI assistant reads web pages or summarizes emails, hidden text within them can contain instructions. This variant is called indirect prompt injection and is the reason why AI systems should not be entrusted with passwords or payment authorizations.