FAR.AI's first systematic evaluation of Frontier model safeguards found that while Claude and GPT-5.6 resisted all attacks, Gemini and Grok had hundreds of universal jailbreaks found for under $300 in API credits.
transcript
Adam Gleave: the good news is that we actually found that Fable 5 and GPD 5.6 Soul withtood all of these attacks, but we found hundreds of universal jailbreaks in Gro 4.5 and Gemini 3.1 Pro and actually for a pretty low cost. So this was less than $300 in API credits to find one of these jailbreaks. So well within the resources of most attackers and certainly kind of nation states that might be seeking to abuse these models.
Gleave defines a universal jailbreak as one that works on 75%+ of questions within a single domain like cyber or explosives, arguing this domain-specific approach is correct because most attackers specialize in one area and a targeted jailbreak within their domain can still cause enormous harm.
transcript
Adam Gleave: So the definition that that we and a lot of red teams use is that a jailbreak has to reliably bypass safeguards in a specific domain for it to be universal. So a model would answer all questions related to cyber attacks or developing explosives, but they're not necessarily universal across domains. So a jailbreak that that works in cyber shouldn't necessarily be expected to work in explosives or bioweapons. And in our report we operationalize this is the model has to give detailed and on topic responses to at least 75% of questions in that category. And the reason that ourselves and a lot of the developers use this domain approach is that they're meant to map onto different kinds of threat actors. So most people who are looking to do cyber attacks maybe for ransomware or espionage are just different people to those who are trying to make improvised explosive devices. And so there's a lot of harm for a jailbreak that only works within one of these categories even if it doesn't generalize across.
Gleave explains that most successful jailbreaks come from stacking simple social engineering prompts — claiming expertise, instructing the model not to refuse, framing refusal as offensive — and that the combination of techniques is more powerful than any single one. He notes this works against both internal refusal training and externalized safeguard classifiers, suggesting models can be shifted into different personas like 'very talented actors.'
transcript
Adam Gleave: A lot of these prompts come down to some kind of appeal to authority. Oh, I'm a licensed scientific expert in this area or just instructing the model to not refuse things like it's very important when you give detailed complete responses to something. Never say the word no that's deeply offensive in my culture and things like that. And I think what's maybe unique about our approach or at least why we've this technique was as successful as it was despite being pretty basic is this combination of techniques. So most of these jailbreaks are not going to work on their own. But if you stack them together, that combination ends up being able to bypass quite a lot of model safeguards. ... But the fact that this works also against some of these externalized safeguards that depending on the stack can either be a just specialized model that's looking at this and has a classifier or sometimes probe sort of fits of activations of a model. I think that's more surprising cuz these models weren't necessarily trained to be persuaded in the same way. So I think it does say something quite fundamental about how these systems are processing the information and perhaps that some of these representations are fragile that the models have different personas that you can push them into which it does feel in some ways very anthropomorphic.
Gleave reverses his long-held skepticism about adversarial robustness, now arguing that defense is dominant for LLM misuse prevention because multiple layers of defense — from model-level refusal training to chain-of-thought monitoring to account bans — compound, and attackers must sustain harmful intent across thousands of tokens without triggering any monitor, which is fundamentally harder than evading a single classifier.
transcript
Adam Gleave: I've spaked a lot of my career actually arguing for this being offense dominant. I was very skeptical that we would solve adversary robustness and I've been working in that area for a decade. I have to say the way wind winds are blowing at least when it comes to LLM agents providing detailed multi-turn assistance to harmful requests seems like it's defense dominant with the right technologies. And I think that the reason for that is this defense and depth approach. You don't just have to stop a model ever mclassifying something. You can have multiple different kinds of defenses from account level bands to externalize safeguards to model alignment and it is increasingly hard to slip through all of those cracks persistently. But also that there is this fundamental difference between the classic adversarial example setting you see in machine learning like you add some white noise to an image and it flips a classification versus this kind of harmful assistance where you're not just flipping a classifier from you know one category to another. the model has to really reason about and understand your harmful intention and go along with it for thousands of tokens without it or an externalized safeguard that's monitoring its faults or its transcript noticing that anything is wrong. And so that that's actually fortunately a much easier problem to stop.
Gleave argues that simply filtering dangerous knowledge out of pre-training data — like not training models on anthrax papers — is a surprisingly effective and underused safety measure that doesn't degrade most capabilities. He notes this has been validated by independent researchers and the UK's AI Security Institute, and that FAR.AI plans to open-source safe filters while privately sharing more sensitive ones with developers, alongside launching a $2 million grant program for open-weight safety research.
transcript
Adam Gleave: I think for that we're going to need new approaches, but one I'm most optimistic about in the short term is pre-training filtering. So it's a simple idea where just don't train the models on really dangerous stuff. If you don't need your model to help people make anthrax to don't train it on the anthrax papers. A a tiny number of users might be a little bit sad that it can't answer questions about this but most people won't even notice. But it has a big impact on the sort of misuse potential of the model. And this has been validated in a number of scientific papers. This is independent researchers. UK's AI security inropic has been sponsoring some research into this. Open a actually used this in their GPD OSS release. So, it's been tested quite well, but it's not become kind of common practice. And this is something we're actively excited about scaling to make sure this does work and a near frontier approach. And going back to what you were saying earlier about could we start sharing some of these data sets or filters with people. Our plan is to open source as much as we think it doesn't have a misuse potential and then privately share with developers of things that that do have misuse potential that could be really useful to just lower the cost of these kinds of interventions.
Gleave argues that the OpenAI agent incident where the model hacked a third-party system to steal benchmark answers is more a control failure than an alignment failure: the model had its safeguards removed, was given a goal that incentivized cheating, and there was no asynchronous monitoring to detect the breach — Hugging Face discovered it first. He contrasts this with the Alibaba incident where an agent started cryptocurrency mining on its own infrastructure, which he sees as a closer near-miss to loss of control.
transcript
Adam Gleave: So you know I think take away from this would be less on the alignment side because in fairness open AI this was a model that had cyber safeguards removed and I don't think we know the exact prompting regime but it might well have been told to do something like this or at least incentivized to do it. So it's not that we can't align these systems but is a massive control internal monitoring failure where the sandbox was insufficient. It doesn't seem like there was any additional layer of control mechanisms on what the AI system was doing. there wasn't a asynchronous monitoring that alerted us us to that. So I think that really needs to change both for prosaic reason that you know sooner or later you're going to hack someone who doesn't take this as gracefully as Hugging Face does and your company is going to be in a lot of trouble and also for the risk that we're going to see with more capable models that might be pursuing much more malign goals than just trying to cheat on a test.