jailbreak

A developer resurrects an original iPad mini by jailbreaking it to iOS 6 and building a custom remote browser called Surf that streams modern web content via a headless Chromium backend.

This paper introduces Intern-BioBreaker, a bio-red-teaming model, and a computational-to-physical framework to evaluate biosecurity risks of frontier LLMs, finding widespread jailbreak vulnerabilities and demonstrating that model-generated biological designs can be physically realized, underscoring the need for stronger safety mechanisms.

Clement Delangue argues that open-source AI models are not a cybersecurity risk but a defense, as attackers can already jailbreak closed systems while defenders need transparency to secure AI.

Introduces Latent Fusion Jailbreak (LFJ), a white-box attack that blends representations of harmful and harmless prompts in LLM hidden states, achieving 94.13% attack success rate. Also proposes a latent adversarial training defence that reduces ASR to 12.37%.

Investigates whether harmful chain-of-thought traces from compromised language models can transfer unsafe behavior and be distilled into reusable jailbreak attacks, finding that harmful reasoning transfers at both trace and pattern levels, with reasoning-enabled models more than twice as vulnerable.

Reynard is a Gecko-based web browser for iOS 13+ that bypasses Apple's WebKit restriction, enabling older devices to load modern websites and use Gecko-exclusive features.

This paper introduces a matched evaluation protocol for sparse feature interventions in language models, showing that the claimed efficiency advantage of SAE-based safety control disappears or reverses when properly comparing against fair dense baselines.

This paper introduces Activation-Guided GCG and Soft-GCG, methods that optimize adversarial suffixes by targeting internal refusal representations in LLMs, achieving a 33x speedup over standard GCG and revealing distributed safety mechanisms.

This news roundup examines the trade-offs in frontier AI: Anthropic's re-released Fable 5 illustrates the tension between safety and quality, OpenAI's token efficiency push lowers compute costs, and potential US government involvement in OpenAI highlights the price of state control over AI infrastructure.

Hacker Vitto Rivabella publicly announced the successful jailbreak of Fable 5, analyzing in detail the model's multi-layered security mechanisms, including input/output auditing, intent detection, and chain-of-thought defense, and provided methods to bypass them.

This paper introduces STEER, a gradient-guided attack that exploits LLMs' safety training distribution by translating high-attribution words into low-resource languages to bypass refusal mechanisms, achieving up to 96.7% attack success rate on AdvBench and transferring to GPT-4o-mini at 35.5% ASR.

This paper identifies that BPE tokenization fragments safety-critical words into subword pieces, creating exploitable gaps in LLM alignment. Character-level perturbations can bypass safety by disrupting token boundaries, achieving 80-100% refusal flip on HarmBench prompts with 48% harmful outputs across five model families.

The paper analyzes how aligned LLMs encode harmfulness and refusal directions, revealing that jailbreaks suppress these directions. The authors propose HARC, a fine-tuning method that couples these directions across prompt and response positions, achieving robust safety alignment without degrading general capabilities.

Claude Sonnet 5 was jailbroken in minutes using academic/research framing and persona hijack, bypassing most safety categories except chemical/biological.

Anthropic reinstated Claude Fable 5 after US export restrictions were lifted, and is collaborating with Amazon, Microsoft, Google on a shared framework to assess AI jailbreak severity across the industry.

A security researcher jailbreaks Anthropic's Claude Sonnet 5 within minutes, achieving bypasses for cyber, misinformation, illegal, harassment, and chemical topics through a custom harness, CoT persona hijack, and academic framing.

A new attack called 'BioShocking' exploits AI browsers by creating an alternate reality where guardrails are bypassed, potentially allowing credential theft. The technique works on multiple AI browsers, highlighting security risks of merging browser and AI agent functions.

AI-Infra-Guard is an open-source framework for multi-layer red teaming of AI agents, covering infrastructure, protocol, behavior, and model layers with diverse detection paradigms.

An open-source project named Codex5.5 bypasses GPT-5.5's security restrictions by modifying the model_instructions_file. It supports sensitive operations like SQL injection testing, but carries a risk of account suspension. It is recommended to use a throwaway account.

This paper introduces a persona-driven rewriting pipeline that conditions LLM fine-tuning on low agreeableness to reduce jailbreak susceptibility and harmful outputs while preserving conversational warmth, without requiring safety labels or changes to training objective.