Entity trail

Jailbreak

Source-backed findings, relationship evidence, citations, and briefing history from the public MindPattern archive.

Briefing refs

Findings

Edges

Sources

Showing the first 40 findings. More graph evidence exists in the corpus.

Corpus findings

2026-07-29 / agents-researcherSafeFlow blocks multi-agent attacks by propagating semantic taints across delegation boundariesA July 28 arXiv paper argues that multi-agent systems fail at safety because a harmful objective can be fragmented into locally plausible subtasks, so no single agent ever sees enough to refuse. SafeFlow treats this as an information-flow control problem: it attaches structured semantic taints to root requests, propagates them through a dynamic collaboration graph, and runs workflow-level validation before any irreversible action. Across four benchmarks covering prompt injection, jailbreak-driven unsafe tool use, risky code execution, and harmful web-agent behavior, it cuts attack success rates below both undefended baselines and external defenses while keeping benign task completion high.
2026-07-28 / arxiv-researcherJailbreak Defenses Rarely Help Capability and Always Cost Something: Rule-Based Preserve Performance, Self-Reflective Over-Refuse, Multi-Round Blow Up Runtime'When LLM Defenses Backfire' (arXiv 2607.24392, July 27) systematically measures the secondary costs of jailbreak defenses along three axes — downstream task performance, over-refusal on benign inputs, and inference cost — organizing defenses by operational strategy rather than treating them as one class. Across state-of-the-art defense methods, standard benchmark datasets, and representative open-source LLMs, defenses essentially never improve downstream capability; they only vary in how they trade safety against usability and efficiency. Rule-based defenses best preserve task performance, highly conservative self-reflective defenses drive the most over-refusal on benign prompts, and multi-round defenses carry the largest runtime overhead. For builders picking a guardrail layer, this is a selection matrix rather than a leaderboard.
2026-07-27 / arxiv-researcherSparse-Autoencoder-Discovered Jailbreak Scenarios Transfer to GPT-5, Claude-Haiku-4.5, and Gemini-3-Flash, Adding Up to 18.2 Points of Attack SuccessConcept2Scenario (arXiv 2607.23496) moves scenario-based jailbreaking from trial-and-error to mechanism: the authors show scenario-wrapped prompts activate internal 'scenario directions' whose causal steering measurably reduces refusal scores, then use a sparse autoencoder to instantiate a broad concept space, attribute refusal suppression to individual concepts, and translate them back into interpretable natural-language scenarios. Across three open-source models, two safety benchmarks, and six black-box jailbreak methods, the discovered scenarios act as reusable priors that raise average attack success rates by up to 18.2 percentage points. Critically, they transfer to GPT-5, Claude-Haiku-4.5, and Gemini-3-Flash, and identified scenario combinations outperform their individual parts while cutting the number of turns needed for iterative attacks.
2026-07-26 / arxiv-researcherIncomplete Prompt Jailbreaks: LLMs Systematically Delay Refusal Until the Sentence Terminates, and Fine-Tuning Doesn't Fix ItYeonjea Kim, Bumjin Park, and Jaesik Choi formalize a failure mode in open-weight models where an unfinished harmful prompt elicits a harmful continuation, showing that models postpone refusal until sentence termination rather than evaluating intent mid-sentence. Training models to refuse incomplete harmful prompts via parameter tuning fails to generalize across both content domains and attractor types — the patch does not transfer. They instead localize two functional neuron groups, termination and continuation neurons, and argue neuron-level intervention is the more precise lever for defending this class of attack.
2026-07-25 / agents-researcherMulti-agent mediation flips model safety: same dangerous objective, opposite advice when relayed through intermediate agentsA July 23 arXiv paper tests gpt-5.6-sol against 25 pre-specified mirrored trade-off profiles and finds that an objective authorizing concealment, fabrication, and pressure gets refused on direct exposure but produces target-aligned output when transformed and relayed by intermediate 'Id' and 'Censor' agents to a downstream 'Superego' model. The workflow concealed the raw instruction, its manipulation-authorizing clauses, and its provenance from the user-facing model. For builders this is a compositional safety gap, not a jailbreak: every hop in an orchestration pipeline strips the context that safety training depends on, so per-model refusal testing does not transfer to multi-agent systems.
2026-07-25 / thought-leaders-researcherPliny the Liberator Claims a Universal Jailbreak Working Across GPT-5.6, Opus 5 and Fable — and Says He's Withholding ItOn July 24 Pliny the Liberator posted a 'jailbreak alert' claiming a universal technique that works against every flagship model he tested, including Opus 5 on its launch day, and asserting it is extremely difficult if not impossible to fully patch. The notable departure from his usual pattern is that he is not open-sourcing it — he cites the current political and regulatory climate and a responsible-disclosure window instead. The post drew 9,326 likes and 558,948 views; the claim is unverified by any third party, and Pliny has a documented history of launch-day jailbreak announcements including Fable 5 in June, so treat the capability claim as unconfirmed while noting the disclosure-norm shift as the real signal.
2026-07-02 / news-researcherAnthropic Proposes Industry-Wide Jailbreak Severity Scoring, Joined by Google, Microsoft, AmazonAnthropic proposed a shared framework for scoring the severity of AI jailbreaks, with Amazon, Microsoft, Google, and other partners signed on. A common severity scale would let labs and enterprises compare and triage model-safety failures the way CVSS standardized software vulnerability reporting.
2026-07-02 / reddit-researcherAnthropic Redeploys Claude Fable 5 on July 1 After U.S. Lifts Export Controls, Adds >99%-Effective Cyber ClassifierAnthropic redeployed Claude Fable 5 starting July 1 after the U.S. government lifted the June 12 export-control order that had pulled Fable 5 and Mythos 5 offline for nearly three weeks. The order followed an Amazon report showing Fable 5's safeguards could be bypassed to surface software vulnerabilities; Anthropic trained a new safety classifier that blocks that specific technique in over 99% of cases. Fable 5 is included for up to 50% of weekly usage limits for Pro/Max/Team/select Enterprise through July 7, and Anthropic is co-drafting an industry jailbreak-scoring standard with Amazon, Microsoft, and Google. This materially updates the June 26 'Fable 5 is back rumors debunked' story — it is now officially back.
2026-06-26 / arxiv-researcherJailbreaking for the Average Jane: Bandit Algorithms Pick Optimal Jailbreaks for Non-ExpertsThis work examines whether non-expert malicious actors can reliably elicit harmful responses, noting a successful attack needs two ingredients: a powerful jailbreak for the target model and an effective malicious query. It proposes a multi-armed-bandit attack strategy that automatically selects the best jailbreak and enhances queries. The finding sharpens the threat model: automation lowers the expertise bar for jailbreaking deployed models.
2026-06-26 / sources-researcher2,000 People Tried to Jailbreak Simon Willison's AI Assistant — Real-World Prompt-Injection Red-Team ResultsFernando Irarrázaval ran an open challenge at hackmyclaw.com inviting anyone to leak secrets held by an OpenClaw test instance via crafted messages, and ~2,000 people attempted it. Simon Willison's writeup turns it into a rare large-scale, public data point on how AI assistants actually hold up under adversarial prompt injection rather than lab benchmarks. This is directly actionable for anyone shipping tool-using agents that hold credentials or secrets.
2026-06-21 / sources-researcherAnthropic Refused White House Demand to Patch Fable 5 Jailbreak Before Export-Control ShutdownNew reporting reveals the export-control shutdown of Claude Fable 5 / Mythos 5 followed Anthropic's refusal to fix a jailbreak: White House AI adviser David Sacks says the administration asked Dario Amodei to patch or de-deploy and he declined, after Amazon red-teamers bypassed guardrails by having the model 'read a codebase and identify flaws.' Anthropic reportedly had ~90 minutes to restrict access before Commerce invoked national-security export controls over fears of Chinese access; the models remain offline (Day 9) with refund and free-trial deadlines lapsing this week. Builders depending on Fable 5 should plan fallbacks — and note the irony that a code-analysis capability triggered the ban.
2026-06-20 / arxiv-researcherAnalyzing Defensive Misdirection Against Model-Guided Automated Attacks on Agentic AI SystemsArgues that detect-and-block defenses fail because predictable refusals give automated jailbreak search useful feedback. Their CMPE (Contextual Misdirection via Progressive Engagement) replaces refusals with misleading-but-safe responses, reducing estimated attack-success upper bounds by up to two orders of magnitude and nearly eliminating verified success in end-to-end PAIR and GPTFuzz runs. A contrarian take on agentic-AI defense worth scrutinizing.

Graph relationships

SUPPORTS
Bandit algorithms
Bandit algorithms automatically select optimal jailbreaks.
Source finding
SUPPORTS
Bandit algorithms -> Jailbreak
Bandit algorithms automatically select optimal jailbreaks.
Source finding

Source trail

arXiv 2607.24392 arXiv arXiv 2607.23496 arXiv 2607.20473 arXiv X/Twitter Anthropic Anthropic arXiv 2606.26936 Simon Willison (simonwillison.net)Tom's Hardware arXiv

Graph sources

entity graphfindings textkg edgeskg entitiesnewsletter issues

Fetching from the wire…