AI models learn secret ciphers from prompts alone, study finds

Frontier language models can learn an encrypted cipher they've never seen before from a handful of in-context examples, then keep using it for the rest of the conversation, no fine-tuning required, per a paper posted to arXiv. That matters because a cipher jailbreak has one job: get a model to say something it would otherwise refuse, then hide the response from anything watching the traffic. The paper reports safety alignment is significantly weakened or bypassed once the exchange moves into the learned encoding, so a model that refuses a request in plain English answers the same request once it arrives in cipher.

The researchers tested this against models from Anthropic, Google and OpenAI, not a single lab's product. A technique that clears all three labs' safety training points at how in-context learning behaves on current architectures generally, not a gap specific to one company's alignment process.

String-level content filtering on agent inputs and outputs takes the direct hit. The paper states plainly that this kind of filtering isn't a control against the technique. A filter scanning for banned words or patterns sees ciphertext, and ciphertext looks like noise, so it doesn't matter how good the filter's word list is when the payload never resembles a word.

The paper doesn't say whether filters checking a model's actions, tool calls it makes rather than text it outputs, would catch the same bypass. That's a real gap for anyone deciding what to trust right now. Text-pattern filtering on agent traffic was already a weak backstop. This is evidence it's not a backstop at all against an adversary with a few turns to establish a shared cipher.