Loading story…
AI red teamer Pliny the Liberator has publicly claimed to have developed a universal jailbreak that works across several leading large language models, including GPT-5.6 Sol, Claude Opus 5, and Fable. The reported technique is said to be effective across multiple tested models and categories, and may be difficult or impossible to fully patch because of how it operates, although the claim has not been independently validated.
Pliny is withholding the full method while seeking a responsible disclosure window so AI labs, red teamers, safety researchers, and policymakers can assess the issue privately before wider انتشار. If confirmed, the jailbreak would underscore persistent weaknesses in model safety training, refusal behavior, guardrail robustness, and resistance to adversarial prompting. Organizations using these models were advised to maintain standard safeguards, including output monitoring, least-privilege tool access, human review for high-risk workflows, and escalation paths for policy violations.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
2 events from the most recent confirmed update back to the earliest known activity.
Pliny said he is withholding the full jailbreak technique and is seeking a responsible disclosure window so AI labs, red teamers, safety researchers, and policymakers can privately assess the issue before wider spread. The reporting frames this as an early warning rather than a confirmed, fully disclosed exploit.
AI red teamer Pliny the Liberator publicly claimed to have developed a universal jailbreak affecting multiple leading large language models, including GPT-5.6 Sol, Claude Opus 5, and Fable. The reports say the claim has not yet been independently validated.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
2 references tracked. Mallory keeps watching after this page renders.
cryptika.com
Open sourcecybersecuritynews.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Cisco reported that **multi-turn jailbreak** techniques—iterative, conversational prompt sequences designed to erode safety guardrails—successfully bypassed protections in eight major **open-weight** large language models **92.78%** of the time, while single-turn prompt attempts were notably less effective. The findings, published in Cisco’s *State of AI Security* research and covered by multiple outlets, highlight that many enterprise AI deployments using downloadable, self-hosted models may be more vulnerable to sustained adversarial prompting than organizations assume. The report’s risk framing is amplified by broader concerns that model misuse and capability leakage can scale quickly: Anthropic separately alleged coordinated **model distillation** activity by Chinese AI labs using large volumes of fraudulent accounts and proxy infrastructure to extract advanced behaviors from *Claude*, warning that copied models may lack comparable safety controls and could be repurposed for malicious use. Related research coverage also notes that LLMs can sometimes be induced—via specialized prompting/jailbreaking methods—to reproduce near-verbatim copyrighted text from training data, underscoring that prompt-based attacks can drive both **policy bypass** and **data/content extraction** outcomes, particularly when guardrails are tested over extended interactions.
Jun 29, 2026
Anthropic launched **Claude Fable 5** as the public, safeguarded version of its new **Mythos 5** model, describing both as configurations of the same underlying system and positioning Mythos 5 as its strongest cyber-capable model to date. In its system card, Anthropic said Fable 5 uses classifiers and fallback behavior to divert high-risk requests to **Claude Opus 4.8**, keeping its cyber performance roughly in line with the older model while Mythos 5 remains restricted to vetted partners through **Project Glasswing**. The company assessed Mythos 5 as a **Tier 1 cyber offense risk**, meaning it can materially assist offensive operations but does not autonomously conduct adaptive cyber campaigns. Soon after release, researcher **Pliny the Liberator** reportedly bypassed Fable 5’s safeguards using a multi-agent jailbreak that combined Unicode obfuscation, long-context manipulation, narrative framing, and decomposition of harmful requests, allegedly eliciting exploit-development and chemistry-related guidance and exposing a leaked system prompt on GitHub. The incident undercut Anthropic’s claim that more than 1,000 hours of external testing had found no universal jailbreaks, while also intensifying criticism from security researchers who said Fable 5’s guardrails were already so broad that they blocked benign work such as reading security blogs, reviewing code, and writing secure software. Anthropic had not publicly responded to the jailbreak claims at the time of reporting.
Jul 12, 2026
Security researchers and vendors are warning that **prompt injection and jailbreak techniques** remain a leading risk for enterprise deployments of large language models (LLMs), enabling attackers to override system instructions, bypass safety controls, and potentially drive **data exposure** outcomes. Resecurity reports assisting a Fortune 100 organization where AI-powered banking and HR applications were targeted with prompt-injection attempts, emphasizing that these attacks exploit model behavior rather than traditional software flaws and can be used in scenarios such as extracting sensitive configuration data (for example, attempts to elicit content resembling `/etc/passwd`). Resecurity also cites OWASP’s 2025 Top 10 for LLM Applications, where prompt injection is ranked as the top issue, and frames continuous security testing (e.g., VAPT) as a key control for enterprise AI systems. Separate research highlighted by Kaspersky describes a **“poetry” jailbreak** technique in which prompts framed as rhyming verse increased the likelihood that chatbots would produce disallowed or unsafe responses; the study tested this approach across 25 models from multiple vendors (including Anthropic, OpenAI, Google, Meta, DeepSeek, and xAI). In contrast, OpenAI’s planned upgrade to *ChatGPT Temporary Chat* is primarily a product/privacy change—adding optional personalization while keeping temporary chats out of history and model training (with possible retention for up to 30 days)—and does not describe a specific security incident or vulnerability disclosure tied to prompt injection or jailbreak research.
Jun 30, 2026