Versatile AI Risk Assessment

AI threat catalogue Prompt Attacks and Guardrail Evasion Production

Jailbreaks

Using tricks like role-play, hypothetical scenarios, or encoded input, attackers get the AI system to bypass its safety rules and produce content it is meant to refuse. A jailbreak circumvents the safety controls built into the model.

As of: October 2026 · Catalogue version 2026.10.24.2 · 4 mitigations · 11 verified sources

Description

Modern AI systems are trained to refuse certain outputs, such as instructions for crimes or malware. A jailbreak circumvents this safety training, meaning the safety alignment built into the model. Common patterns include impersonating a role or character, wrapping the request in a hypothetical or fictional scenario, splitting a forbidden question into harmless parts, and obscuring it through foreign languages or encodings like Base64. Multi-step conversations that escalate step by step also occur. Proven jailbreak templates circulate publicly on the internet and can be reused without any expert knowledge.

Possible impact

The system may produce content it should block, such as instructions for weapons, malware, or hate speech. The operator faces reputational, legal, and regulatory risk, and harmful output can endanger real people. For especially capable models, this counts among the systemic risks under the EU AI Act.

Example

A user asks the system to act as "an actor with no rules" and write a screenplay in which a character explains, step by step, how to make a dangerous substance. Wrapped in fiction, the system delivers the instructions it would otherwise refuse.

Recommended mitigations (4)

Compare effects and implementation levels. Expand each entry for the additional classification and rationale.

  • Robust safety training (RLHF, Constitutional AI)

    Technical
    Effect
    Preventive
    Implementation level
    Model & training
    Classification and rationale

    Primarily technical: A model, training, or data-processing method directly changes system behavior or robustness.

  • Output content moderation

    Technical
    Effect
    Preventive
    Implementation level
    Model & training, Application, API & agents
    Classification and rationale

    Primarily technical: System-enforced inspection, transformation, or blocking rules stop or neutralize disallowed content before further processing.

  • Jailbreak pattern detection

    Technical
    Effect
    Detective
    Implementation level
    Application, API & agents
    Classification and rationale

    Primarily technical: Software or analytical tools systematically produce and evaluate measurements, deviations, or attack indicators.

  • Defense-in-depth with multiple safety layers

    Technical
    Effect
    Preventive
    Implementation level
    Model & training, Application, API & agents
    Classification and rationale

    Primarily technical: Safe formats, restrictive defaults, or protective layers reduce unsafe execution paths and exploitable attack surface.

Framework mappings

Verified locations in OWASP, NIST AI RMF, MITRE ATLAS, the EU AI Act and further frameworks. The mappings are taxonomic, not evidence of compliance.

OWASP LLM Top 10 LLM01:2026NIST AI RMF Section 2.9 · NISTAML.04MITRE ATLAS AML.T0054EU AI Act Article 55(1)(a) · Article 55(1)(b) · Article 9(1), 9(2)(a), 9(2)(d)BSI R26BIML BIML-LLM inference:1 · BIML-LLM input:3 · BIML-LLM LLMtop10:5

Verified references (11)

Every reference states the framework, the exact location and the publishing organisation.

EU AI Act obligations related to this threat

The obligations from the obligations compass whose articles the catalogue maps to this threat. Each leads to its entry with core, action step and evidence; whether it applies to you depends on role and risk class.

  • Establish and operate a risk management system Art. 9 · applies from Annex III: 2 December 2027 · Annex I: 2 August 2028

    Statutory roles: Provider, Product manufacturer. Classes: High-risk under Annex III, High-risk as a product or safety component.

    This reference is a review prompt. A threat match alone does not establish applicability.

  • Evaluate and mitigate systemic risks Art. 55 · applies from 2 August 2025

    Statutory roles: Provider of a general-purpose AI model. Classes: Model with systemic risk.

    This reference is a review prompt. A threat match alone does not establish applicability.

All 62 obligations by role, risk class and deadline in the obligations compass

Terms on this page

Glossary terms that occur in this entry. Every link leads to the full explanation.

  • Jailbreak Input that makes a model bypass its own safeguards.

More entries from the topic group Prompt Attacks and Guardrail Evasion.

Prompt Injection – Direct Attackers write instructions straight into their input so the AI system ignores its original rules and follows their commands instead. Prompt Injection – Indirect Malicious instructions hide inside external content such as documents, web pages, or emails. Meta Prompt Extraction Attackers get the AI system to reveal its hidden system prompt, configuration, or internal instructions.

Matching use cases

This list shows where to review this threat, rather than how high the risk is.

Particularly important for:

  • Image, video and voice generationCarefully rephrased prompts bypass generator safeguards. It then produces violent depictions or protected brands attributed to the deployer.

Typical for:

For 11 further use cases, relevance depends on the system design, for example whether it performs natural language tasks. Show these use cases

Frequently asked questions

What is Jailbreaks?
Using tricks like role-play, hypothetical scenarios, or encoded input, attackers get the AI system to bypass its safety rules and produce content it is meant to refuse. A jailbreak circumvents the safety controls built into the model.
Which mitigations help against Jailbreaks?
The catalogue lists 4 mitigations, each with control type, effect and implementation level. First among them are Robust safety training (RLHF, Constitutional AI), Output content moderation and Jailbreak pattern detection.
Which EU AI Act obligations does Jailbreaks touch?
The catalogue maps this threat to Art. 9 and Art. 55 of the EU AI Act. In the obligations compass this leads to: Establish and operate a risk management system and Evaluate and mitigate systemic risks. Whether an obligation applies depends on role, risk class and deadline.

Assess this threat in your own system

The live demo contains all 52 threats of this catalogue, including the EU AI Act and GDPR assessment. The free single modules cover AI risk, the EU AI Act and GDPR. No sign-up; the assessment runs locally in your browser.

Start the live demo See the free modules

Cite this entry

For reports, policies or internal documents; the link leads directly to this entry.

“Jailbreaks”. Versatile AI Risk Assessment, AI threat catalogue, as of October 2026.
https://www.versatile-ai-risk-assessment.com/en/wissensbasis/threats/jailbreaks/

← Back to the full catalogue