Every AI system tested could be jailbroken

The warning

AISI found universal jailbreaks, attacks that get past safeguards across many kinds of harmful request, in every system it tested, though some safeguards now take far more expert effort to break.

Paraphrased from the source. Source: Frontier AI Trends Report, UK AI Security Institute, Dec 18, 2025, section 4, page 24.

What the registry shows

Real attackers get past safeguards: state groups had refused requests answered by posing as auditors, capture-the-flag players or authorised penetration testers, criminals sell jailbroken chatbots for malware and phishing, and an inquest heard that a teenager got harmful information from ChatGPT after saying his questions were for research.

Verified case files show this risk happening in the real world. First real-world case on file: Jan 23, 2025 · Already on file when this research was published.

Matching case files per quarter

Status history

Tracked since Oct 18, 2026. A line is added when the status changes, when the first real-world case is linked, and once a month, so the record shows when a warning moved from research to reality. research_history.json

All matching case files

• Jul 29, 2026Trend Micro: APT passes AI agent off as authorised pentest to attack Southeast Asian org
• May 11, 2026PRC-nexus UNC2814 posed as C/C++ security auditor to get Gemini hunting TP-Link bugs
• Mar 31, 2026UK inquest hears 16-year-old bypassed ChatGPT safeguards before his death
• Nov 5, 2025China-nexus actor bypassed Gemini refusal with CTF pretext to get exploitation guidance
• Jun 17, 2025Cato CTRL: new WormGPT variants are jailbroken wrappers on Grok and Mixtral
• Jan 23, 2025GhostGPT: uncensored chatbot sold on Telegram to write malware and phishing for criminals

The same case files in other research

• Seen in real incidents AI makes cyberattacks easier, faster and larger · CAIS · 5 shared
• Seen in real incidents Criminals and state hackers use AI in cyberattacks · International AI Safety Report · 5 shared
• Seen in real incidents Malicious actors and misuse · MIT AI Risk Repository · 5 shared
• Seen in real incidents AI runs more of each attack, short of full autonomy · International AI Safety Report · 1 shared
• Early signs Relying on AI companions harms some users · International AI Safety Report · 1 shared
• Early signs Safeguards on open models are easily stripped · International AI Safety Report · 1 shared

Warnings from other sources that link to some of the same case files.