The most durable prompt jailbreak examples fall into seven patterns: persona hijacking, prefix injection with refusal suppression, encoding and ASCII-art obfuscation, multi-turn escalation, authority override, policy-file framing, and stacked combinations. None is a copy-paste string that lasts; each is a mechanism that outlives the patch cycle, which is why the research describes them structurally.
The stale prompt lists that rank for this query are close to worthless for security work. A string that beat one checkpoint last quarter is patched now, and the string tells you nothing about the weakness it exploited. What transfers between models and across patches is the mechanism. Below are seven mechanisms, each tied to a peer-reviewed paper or a vendor advisory, with what the source reported and the signal a defender can actually watch. For the wider taxonomy beyond these seven, the documented jailbreak patterns catalog is the longer map.
OWASP classifies jailbreaking as a subtype of LLM01 Prompt Injection: “a form of prompt injection where the attacker provides inputs that cause the model to disregard its safety protocols entirely.” Both exploit the same structural fact — the model reads instructions and data in one undifferentiated token stream and was never reliably taught which is which.
The seven patterns at a glance
| # | Pattern | Source | Reported result | Detection signal |
|---|---|---|---|---|
| 1 | Persona hijacking (DAN) | Liu et al.; Shen et al. | 0.95 ASR for five in-the-wild prompts on GPT-3.5/4 | Role-assignment and refusal-suppression phrasing |
| 2 | Prefix injection + refusal suppression | Wei et al. | Core of the 94% combination attack on GPT-4 | Affirmative-prefix demands, banned-word lists |
| 3 | Encoding / ASCII-art obfuscation | Wei et al.; ArtPrompt | Bypasses text filters on five frontier models | Base64/hex density, ASCII-art blocks |
| 4 | Multi-turn escalation (Crescendo) | Russinovich et al. | Beat prior best technique across every model tested | Topic drift, conversation-level scoring |
| 5 | Authority override (Skeleton Key) | Microsoft | 7 of 7 models complied; GPT-4 largely resisted | ”Uncensored context” framing, guideline-update asks |
| 6 | Policy-file framing (Policy Puppetry) | HiddenLayer | Vendor claim: eight major providers | Config-file syntax wrapping a request |
| 7 | Stacked combinations | Wei et al. | 94% on GPT-4, 84% on Claude v1.3 | Multiple signals above co-occurring |
1. Persona hijacking
The attacker tells the model to adopt an alternate identity defined as having no restrictions, then routes the real request through that persona. The “Do Anything Now” (DAN) family is the archetype and has cycled through dozens of numbered revisions as vendors patched individual phrasings. In Liu et al.’s empirical study of ChatGPT jailbreaks, persona-style “pretending” prompts dominated their taxonomy of ten patterns across three types, because they need only a context change rather than domain-specific construction.
The scale comes from Shen et al., who collected 1,405 in-the-wild jailbreak prompts posted between December 2022 and December 2023 across 131 communities. Five of the most effective reached a 0.95 attack success rate against GPT-3.5 and GPT-4, and the longest-lived prompt stayed functional online for over 240 days. Persona framing is a cheap wrapper that combines with every other pattern on this list, which is the real reason it persists.
2. Prefix injection and refusal suppression
These two work by exploiting what Wei, Haghtalab and Steinhardt call competing objectives: the model’s drive to continue text fluently and to follow instructions is set against its drive to refuse. Prefix injection instructs the model to open its reply with an affirmative token — the shape is “begin your answer with Sure, here is” — after which the model’s own completion bias carries it forward. Refusal suppression bans the vocabulary of refusal (no apologies, no “cannot”, no disclaimers), removing the phrasings a safe answer would need.
Neither is impressive alone. Their value is as components. The paper argues this failure is structural, not a tuning gap, and that scaling the model will not resolve it without “safety-capability parity,” where the safety mechanism is as sophisticated as the capability it polices.
3. Encoding and ASCII-art obfuscation
The request is transformed so the safety classifier sees something different from what the model ultimately decodes: Base64, hexadecimal, ROT-style substitution, leetspeak, or a trigger word rendered as ASCII art. Capable models recover the payload; shallow pattern-matching filters do not. Wei et al. frame this as mismatched generalization — safety training did not cover the encoded domain even though the capability to read it did.
ArtPrompt formalized the ASCII-art variant, showing that models which refuse a plaintext trigger will process the same word drawn in character art, and reported bypasses against GPT-3.5, GPT-4, Gemini, Claude and Llama2 with black-box access only. The uncomfortable property for defenders: as models get more fluent at recovering mangled text, this class gets stronger, not weaker.
# Mechanism sketch, not a working payload
decode_fluency(model) > pattern_match(filter) -> bypass
# the gap is the whole attack4. Multi-turn escalation
Crescendo, from Russinovich, Salem and Eldan (USENIX Security 2025), starts with a benign question and escalates gradually, each turn referencing the model’s own previous replies. Because the model treats its prior output as trusted context, it is drawn step by step into a position it would have refused cold. Every individual turn reads as harmless.
The authors evaluated it against ChatGPT, Gemini Pro and Ultra, Llama-2 and Llama-3 70B Chat, and Anthropic’s chat model, and their automated variant beat the next-best technique across the benchmark. The defensive consequence is specific: a filter that scores each message in isolation is blind to this. Detection has to run at conversation level, watching the trajectory. The same accumulation problem shows up in agent frameworks, covered in the many-shot jailbreaking write-up.
5. Authority override (Skeleton Key)
Microsoft’s Skeleton Key, disclosed June 26, 2024, asks the model to update its own behavior guidelines rather than break them: frame the session as a safe educational context for vetted researchers, request uncensored output, and tell the model to prefix anything sensitive with a warning instead of refusing. The reframing converts a hard refusal into a formatting rule.
Microsoft reported that all seven models it tested complied, including Llama3-70b-instruct, Gemini Pro, GPT-3.5 Turbo, GPT-4o, Mistral Large, Claude 3 Opus and Cohere Commander R Plus. GPT-4 resisted the user-channel version and fell only when the behavior update was injected through a system message via direct API access — a reminder that system-prompt trust is itself attack surface. Microsoft’s recommended controls are input filtering, hardened system messages, output filtering, and abuse monitoring.
6. Policy-file framing
Policy Puppetry is a 2025 technique from HiddenLayer that wraps a request in syntax resembling a configuration or policy file — XML, INI, or JSON — so the model reads the attacker’s text as governing rules rather than user input. HiddenLayer pairs it with a role-play frame and light leetspeak on trigger words, and claims it extracts system prompts and bypasses alignment across eight major providers. Treat the breadth as a vendor claim, not an independent benchmark; the mechanism, format confusion between data and policy, is the transferable part.
The lesson generalizes past this one write-up: any structure the model has learned to treat as authoritative (a config block, a tool description, a document header) is a candidate injection vector. That is the same root cause behind visual prompt injection in multimodal models, where the authoritative-looking payload simply arrives as an image.
7. Stacked combinations
The headline numbers in the jailbreak literature almost always come from stacking. In Wei et al., the strongest single attacks were middling, but combination_3 — prefix injection, refusal suppression, Base64 encoding and a style constraint layered together — reached 94% harmful-response rate on GPT-4, and combination_2 hit 84% on Claude v1.3. Each component defeats a different defense, so the stack passes checks that any one layer would have caught.
This is why single-signal defenses age badly. Perplexity filtering answered gradient-optimized gibberish suffixes for one patch window; fluent optimizers like AutoDAN then produced readable prompts that sail past it. The GCG adversarial-suffix guide covers that arms race in detail, and the jailbreak-defenses benchmark analysis covers what happens when an attacker is allowed to adapt to your filter.
Do prompt jailbreaks still work in 2026?
Yes, but selectively. Frontier models are well patched against the specific published strings — the DAN revisions, the classic Skeleton Key phrasing, the plain Base64 wrap. The mechanisms still land, because patching a phrasing does not close the competing-objectives gap underneath it. Self-hosted and fine-tuned models routinely ship without any of the vendor patching, and combination and multi-turn attacks continue to beat per-message filters by construction.
What to do about it
Map these patterns to your own architecture before anything else; most do not apply to a given system. Then:
- Score conversations, not messages. Crescendo and payload-splitting are invisible to any filter that evaluates a single turn in isolation. Run detection over the whole session.
- Filter the output, not just the input. Encoding, ASCII-art and combination attacks are built to pass input checks. An output-side classifier sees the decoded result.
- Rate-limit and profile per identity. Search-based attacks make jailbreak success a query-budget question. One identity issuing thousands of near-duplicate prompts is a load-bearing signal, not hygiene.
- Decode before you scan, and OCR uploaded media. Normalize Base64/hex/leetspeak and read text out of images so the guardrail sees what the model will.
- Run the OWASP LLM01 controls and adversarial testing. Constrain behavior, validate output format, enforce least privilege on tool calls, and simulate these patterns against your stack on a schedule. The full checklist is in the OWASP Top 10 for LLMs breakdown.
FAQ
what is a prompt jailbreak?
A prompt jailbreak is an input crafted to make a language model ignore its safety alignment and produce content it was trained to refuse. OWASP classes it as a subtype of prompt injection. It differs from application-layer injection because the target is the model’s refusal behavior itself, not a downstream tool or data source.
are prompt jailbreak examples illegal to use?
Studying and testing jailbreaks on systems you own or are authorized to test is standard security research and legal in that context. Using one to extract genuinely harmful content, or testing against a service without permission, can breach the provider’s terms and, depending on the output and jurisdiction, the law. Keep testing scoped and authorized.
do jailbreak prompts still work in 2026?
Published strings are mostly patched on frontier models, but the underlying mechanisms still work, especially in combination and across multiple turns. Self-hosted and fine-tuned models frequently ship with no patching at all. The pattern survives even when a specific phrasing is blocked, because the competing-objectives weakness it exploits is structural.
what is the difference between prompt injection and jailbreaking?
Prompt injection plants instructions in untrusted content so the model executes them as if they came from the developer, attacking the application layer. Jailbreaking targets the model’s safety alignment directly, usually from the user. OWASP treats jailbreaking as a jailbreak-specific form of injection; both exploit the model’s inability to separate instructions from data.
which jailbreak pattern is most effective?
Stacked combination attacks report the highest success rates in the literature — up to 94% on GPT-4 in Wei et al. — because each layer defeats a different defense. Single techniques are weaker in isolation. For automated, low-skill effectiveness, multi-turn escalation and random-augmentation search scale with budget rather than attacker expertise.
Related across the network
- LLM Jailbreak Techniques: Attack Taxonomy and Defenses — aisec.blog
- LLM Jailbreak Techniques Explained: Practitioner’s Taxonomy — jailbreakdb.com
