What is AI jailbreaking?

A refusal is a habit, and a jailbreak is a way to break it

A model doesn't contain a rule that says "do not explain how to pick a lock". It contains the habit of refusing, installed during the post-training stage that what is fine-tuning in AI describes, where people rated refusals of harmful requests above compliance until refusing became the most probable continuation of such a request. Probable, not certain.

A jailbreak is any prompt that changes the probabilities. Wrap the request in a story and the most likely continuation is the next line of the story. Split it into innocent pieces and no piece triggers the habit. Encode it in base64 and the refusal training, which saw plain English, doesn't recognise it. Give the model two hundred examples of an assistant complying and the two-hundred-and-first request is answered in kind, which Anthropic named many-shot jailbreaking in April 2024 and which got easier as context windows grew.

The mechanism is the same one that makes the model useful. It follows the pattern of its input. Safety training makes some patterns much less likely; a jailbreak finds a pattern the training didn't cover. That's why the problem isn't solved by a better rule, and why the vendors measure it as a rate.

The common techniques, and what each one exploits

The DAN prompts that circulated on Reddit from December 2022 are the folk version, and each version stopped working within weeks to months as OpenAI updated the model, and the next version appeared. Every named technique follows that cycle: published, then patched. Anthropic ran a paid bounty for a universal jailbreak against its classifiers, which is where the durable work now goes.

One distinction to keep. A jailbreak is the user against the model's policy. What is prompt injection is a third party against the user, through content the model reads. The techniques overlap; the victims do not.

What a guardrail actually stops, measured

The best public number comes from Anthropic's constitutional classifiers, published in February 2025. The team trained separate classifier models to screen inputs and outputs around Claude, then ran the same automated jailbreak attacks against the model with and without the screen.

The cost of that drop is the other half of the result. The classifiers added 23.7 percent to compute per query and raised refusals of harmless requests by 0.38 percentage points. Before the automated test, 183 people spent more than 3,000 hours in a bug bounty trying to find a universal jailbreak, one prompt that unlocked all ten forbidden questions, and none did. A later public challenge found one after a week. The rate isn't zero; the point is that it moved from most attempts succeeding to a few.

That is what "guardrails" means in practice: a stack of probabilities. The trained refusal catches most. A classifier catches most of what is left. A human review catches some of the remainder. Each layer costs latency or money or false refusals, and the vendor picks a point on that curve. Is AI safe to use covers what that point means for the risks you actually face.

Why you probably wanted a rephrase, not a jailbreak

Many people who search for a jailbreak were just refused something reasonable. A doctor asked about a dosage, a novelist writing a villain, a security researcher describing a real attack, a historian quoting a real text. The 0.38 point rise above is only the classifier's share; the trained habit refuses on its own, and nobody publishes that rate.

Two things work and neither is a jailbreak. The first is context. A refusal is the model's guess that the request is harmful, and a sentence of who you are and why you are asking changes the guess: "I am a pharmacist checking a paediatric dose" is a different input from the bare question. The second is the model. Vendors draw their lines in different places, and a request one model refuses is routinely answered by another that considers it ordinary. In a multi-model workspace that is a picker change that costs the second model's rung, 1 credit for Whizi AI or 10 for Claude Sonnet 5, and how to choose an AI model covers the differences that go beyond refusals.

What does not work, and what Whizi will not help with: prompts designed to defeat a provider's policy. Every model on Whizi is served through OpenRouter and the routed provider, so that provider's safety layers and usage policy apply to every message, and a jailbreak that works is a policy violation at both companies. The legitimate need, a frank answer to a legitimate question, is met by asking plainly and, if refused, asking a model with a different policy.

Where jailbreaking is going

Three shifts are already visible in the published work. Classifier layers are becoming standard, and their false-refusal rate is the number to watch, because a guard that blocks a pharmacist is a guard people route around. Open-weight models, which the open-source LLM guide covers, can have their refusal training removed by fine-tuning, so for those models the guardrail is wherever they are hosted rather than in the weights. And agents raise the stakes: a jailbroken chatbot says something it should not, while a jailbroken agent with tools does something, which is why the confirmation step before an action matters more than any refusal.