An ordinary system prompt with nothing to do with safety moved jailbreak success from 2% to 58%

arXiv 2608.30748·high signalXBlueskyLinkedInCopy link

Across seven aligned models and three jailbreak attacks, holding the attack fixed and changing only a routine system prompt shifted attack success rate by up to 56 percentage points. The increases showed up even for attacks that were designed and tuned against the default configuration, and the swing tracks projections onto a refusal-related axis in hidden representations. Any red-team number you have measured in one prompt configuration does not transfer to the configuration you actually ship.