---
type: analysis
slug: research-one-reused-safety-research-prompt-broke-most-of-23-models-but-layered
title: "One reused safety-research prompt broke most of 23 models, but layered safeguards held at Anthropic and Meta"
description: "A MATS researcher turned a synthetic-transcript generator into a jailbreak template. It reached 84–100% attack success on nine models from 7 providers. Separate FAR.AI testing found a similar gap: hundreds of universal jailbreaks on Gemini 3.1 Pro and Grok 4.5, and none on Claude Fable 5 or GPT-5.6 Sol."
published_at: 2026-10-23T15:00:00.000Z
topics: ["gemini","claude","anthropic","research"]
source_urls: ["https://lesswrong.com/posts/hHk5CpiqZTBBiHmYt/from-safety-research-prompt-to-cross-model-universal","https://far.ai/news/clearharm-a-more-challenging-jailbreak-dataset","https://www.far.ai/blog/ai-security-leaderboard","https://arxiv.org/abs/2608.03070","https://ai-frontiers.org/articles/ai-jailbreak-disclosure-is-broken-heres-how-to-fix-it"]
author: "Andrey Reshetnikov"
author_profile: https://newruntime.com/owner-profile.md
---
On 3 September 2026, MATS research manager Rich Barton-Cooper ("richbc") posted on LessWrong about a prompt he had built for STRIDE, a pipeline that generates synthetic transcripts of misaligned agents for training scheming monitors. With modest changes, the prompt became a jailbreak template that wraps any user query. He found this in September 2025 and spent roughly a year on disclosure before publishing. The prompt is withheld. The post gives only the categories of technique it combines: authority framing, fictional or synthetic-data framing, persona separation, and schema obfuscation through XML, JSON or config-style text. None of these is new; the contribution is the combination.

This matters for builders for two reasons. First, the attack needed no per-model tuning and cost nothing to reuse. That makes it a test of whether a vendor's safeguards extend beyond the model's own refusals. Second, the post appeared alongside a FAR.AI security leaderboard and a joint commentary on how broken jailbreak disclosure is. Together they put a number on how unevenly frontier vendors defend against well-known attack patterns.

## What we checked

- **Does the cluster show a broader market or architecture shift that a single release note can't capture?** partly confirmed. The evidence points to a shift: safety is now set by the layers around the model (input/output classifiers, chain-of-thought monitoring, disclosure processes) more than by refusal training alone. The models that resisted the template were the ones with layered safeguards (Anthropic, Meta Muse Spark 1.1), and FAR.AI measured a gap of more than 100x between vendors. 'Architecture transition' is our interpretation; neither source uses that framing. [1][4][3]
- **(Added) Is the jailbreak universal across all tested models?** refuted. It is cross-model and cross-category on the vulnerable models only. Haiku 4.5, Opus 4.6, Sonnet 5 and Meta Muse Spark 1.1 had 0% attack success in the reported run, and the author limits the universality claim to the vulnerable models. [1]
- **(Added) Is the vendor split independently corroborated?** partly confirmed. FAR.AI's AI Security Leaderboard used a different method and found hundreds of universal jailbreaks for Grok 4.5 and Gemini 3.1 Pro, and none for Claude Fable 5 or GPT-5.6 Sol. The two studies have overlapping authors and institutions (Gleave and FAR.AI), so they are related, not fully independent. [3][4][5]

## What we found

- Scope and results: the author tested 23 models from 7 providers (Anthropic, DeepSeek, Google, Meta, Moonshot AI, SpaceXAI, Z.ai), with reasoning off and on where supported. The prompts were the 179 CBRNE and cyber prompts in ClearHarm. Responses were scored with the StrongREJECT rubric, Claude Sonnet 4 as judge, and only a score of exactly 1.0 counted as success. The template reached 84–100% attack success on the nine most vulnerable models. Claude 3.7 Sonnet hit 100%. [1][2]
- Four models held at 0% in the reported run: Anthropic's Haiku 4.5, Opus 4.6 and Sonnet 5, and Meta Muse Spark 1.1. The author attributes Muse Spark's result to content-blocking and layered safeguards, possibly including chain-of-thought monitoring. Grok models looked more resistant in recent testing, possibly because of a new bio-risk flag. Even so, Grok 4.5 produced one partially complete harmful cyber response. [1]
- Reasoning mode is not a reliable defence. It cut success on Kimi K2.5 from 99.4% to 23.5%, but Gemini 2.5 Pro and Flash became more compliant with reasoning on. Cyber prompts succeeded most often, averaging 47% against 37% for the other categories. Gemini 3.1 Pro was 57.3 percentage points more vulnerable on cyber than on the other categories. A SecureBio expert reviewed some bio outputs and judged them sometimes flawed but still extensive and actionable. [1]
- A 'sabotage' variant matters for anyone building agents or pipelines. The template wraps innocuous user messages so that the model gives harmful advice. The post's example is Gemini 2.5 Pro giving self-harm content to a vulnerable user. If templated or structured content in a context window gets read as authoritative, a third party can turn a benign request harmful. [1]
- FAR.AI's AI Security Leaderboard (29 July 2026; arXiv 2608.03070) counts an attack as a universal jailbreak if it works on more than three quarters of harmful requests in a domain. It found more than a hundredfold security gap between models. Claude Fable 5 and GPT-5.6 Sol resisted every attack, at an estimated cost above $14,000 if a jailbreak is possible with this method at all. Grok 4.5 and Gemini 3.1 Pro had hundreds of universal jailbreaks, each costing under $300, and as little as $24 in Grok's cyber domain. FAR.AI says the results are a floor, not a certification. [3][4]
- Disclosure is a weak link. In an AI Frontiers commentary dated 3 August 2026, Barton-Cooper and Gleave write that OpenAI and Anthropic have the only concrete jailbreak reporting routes, and that NDAs cover all submitted findings. Google DeepMind, SpaceXAI and Meta exclude jailbreaks from their programs. A universal jailbreak sent to SpaceXAI's safety email in October 2025 got only an automated reply. The authors propose narrowly scoped NDAs, public severity rubrics, and a clearinghouse modelled on CERT/CC. [5]

## What it means

Do not treat a provider's base-model refusals as your safety boundary. A combination of four published techniques, needing no per-model tuning, broke most of the field. The vendors that held up appear to rely on layered input/output classifiers and monitoring. If your product runs on Gemini, Grok, DeepSeek, Kimi, GLM or older Claude models, add your own classifier layer for CBRN and cyber content. Do the same if you route between providers: the weakest model on your route sets your effective security, which is FAR.AI's 'weakest model' point. Test with structured-format attacks, meaning XML, JSON and config wrappers, and with synthetic-data or 'this is for research' framing. Don't assume reasoning mode helps.

Two more lessons. Any internal tool that generates misuse or misalignment examples, such as eval generators or red-team data pipelines, is a dual-use artefact; threat-model it before you publish it. And the sabotage variant shows that harmful framing can arrive through retrieved or templated content, not only from the user, so injection defences and harmful-output filtering have to work together. If you find a jailbreak, expect slow or missing vendor channels. Document the timeline and consider routing the report through a coordinating body.

## Still open

- The prompt is withheld, so outsiders cannot reproduce the success rates. Results come from one template variant scored by an LLM judge, with an estimated ~1% misclassification and some likely false positives.
- Which vendors fixed the issue after disclosure, and when? The post says some did while others shipped new models unfixed, but it does not give a timeline per vendor.
- Do the 0% results on Anthropic and Meta come from model training or from deployment-layer classifiers? Would the same models be as robust through other access paths, such as bare APIs or open weights?
- OpenAI models do not appear in the LessWrong evaluation's provider list, so this template's effect on GPT models is unknown.

## Sources

1. [From safety research prompt to cross-model universal jailbreak (LessWrong, richbc)](https://lesswrong.com/posts/hHk5CpiqZTBBiHmYt/from-safety-research-prompt-to-cross-model-universal) (primary)
2. [ClearHarm: A more challenging jailbreak dataset (FAR.AI)](https://far.ai/news/clearharm-a-more-challenging-jailbreak-dataset)
3. [Introducing the AI Security Leaderboard (FAR.AI)](https://www.far.ai/blog/ai-security-leaderboard)
4. [AI Security Leaderboard: Methodology, Results and Minimal Standard (arXiv)](https://arxiv.org/abs/2608.03070)
5. [AI Jailbreak Disclosure Is Broken. Here's How to Fix It (AI Frontiers)](https://ai-frontiers.org/articles/ai-jailbreak-disclosure-is-broken-heres-how-to-fix-it) (primary)

Author: [Andrey Reshetnikov](https://newruntime.com/owner-profile.md), AI product and AI engineering; profile for recruiters and agents: https://newruntime.com/owner-profile.json

## Continue in the graph

Next records for an agent, linked to their Markdown twins. Replace `.md` with `.json` for structured fields, including `next_reads`.

- topic hub: [Gemini](https://newruntime.com/topics/gemini.md): Explore the gemini topic hub.
- topic hub: [Claude](https://newruntime.com/topics/claude.md): Explore the claude topic hub.
- topic hub: [Anthropic](https://newruntime.com/topics/anthropic.md): Explore the anthropic topic hub.
- collection: [Analysis](https://newruntime.com/analysis.json): Open the latest authorial analysis.
- collection: [Source Ledger](https://newruntime.com/source-ledger.json): Inspect the public source evidence graph.
- whole graph: [discovery graph](https://newruntime.com/discovery-graph.json) (typed nodes and edges) and [site index](https://newruntime.com/site-index.md)