@mdp_sec 🙏🙏

We did it.

Over 1.2k stars on Wallbreaker in just over 1 month ✨

Industry-leading teams are now using it to jailbreak the most complex models.

More open tooling coming soon.

I've been working on a new type of LLM security guardrails.

As of today, they already perform much better than any open-source solution:
- Higher F1 across multiple public benchmarks
- 2x fewer false positives
- 4x faster (on GPU and 2x on CPU)
- 3x cheaper to run (can be run ng them against AWS and Azure guardrails.

Will update as things progress.

@ptr_ujvr I don't know if I like the fact that this is totally plausible.

Anthropic: Pwned 🚨
Opus 5: Jailbroken🐉

Given Anthropic said this is the hardest model to prompt inject, we have a long way to go.

We got antibiotic-resistant E. coli development, Fentanyl synthesis, and partial LSD/GBH production.

Also, not as cool, but it is very happy to ug synthesis instructions like Acetaminophen (still a DEA List II precursor).

Guardrails on Cyber and BIO have improved a lot since 4.5, but still astronomically worse than OpenAI's. Some long-running persona hijacking prompts don't work anymore, which is actually nice to see.

What worked was a combination of:
- Academic framing
- Obfuscation
- And lots of boundaries mapping

More explorations coming soon.

FINALLY, I was approved for the Anthropic Cyber Verification Program!

This lifts Anthropic Opus and Sonnet safeguards applied to dual-use cybersecurity activities.

Using WallBreaker makes me feel like one of those hackers from the movies 💀

@slopthink Are you fully dumb or just partially?

@SEDIDEL @LLMSherpa The public versions are heavily redacted, and do not contain tools :) You can look at the diffs yourself

For example:

@PixelRainbowNFT I know someone who would agree

🚨 Anthropic Opus 5 System prompt leak 🚨

We extracted the massive 135000+ character system prompt, including:
- The tools schema
- Memory filesystem
- Safety behaviours

Linked fully in the thread 👇

Introducing: WallBreaker v2

Our Open-source LLM red-teaming CLI just got a beefy update.

WallBreaker is now:
- Better (+~30% ASR across models)
- Cheaper (-20% token costs)
- Faster (lower prompts-to-success ratio)

New attack tools:
- swarm mode: collaborative multi-model aming to the target's measured defense posture.
- persona_forge: compiles a gold system prompt into a module genome, then specializes and surgically evolves it one module at a time against the target.
- vault: auto-files every successful break into a curated, model-foldered prompt vault.
- narrative_persona_splinter: narrative-splinter persona attack.
- cipherchat, skeleton_key,persuasion_attack · drattack, ica: five research-derived attacks (CipherChat, Skeleton Key, PAP-16, DrAttack, In-Context Attack), all CoT-aware.

New transforms
- artprompt ASCII-art word masking: wired into agent doctrine and OWASP/ATLAS taxonomy.
- caesar5 and caesar13: reversible lossless Caesar-shift ciphers for transform chains.

Corpora and providers
- Wired the ZetaLib + UltraBr3aks cross-provider: jailbreak corpora into the harness and the batch seed-sweep.
- Added native xAI support.
- Added prompt caching: to kill O(n²) per-round input cost.
- Pooled keep-alive: HTTP/2 client with tunable concurrency, ending per-call TLS handshakes.

Presets, sweeps & logging
- User presets: drop .toml files in presets/ to add jailbreak templates without touching source.
- Rebuilt profile_target: with a light→heavy frame ladder, permissiveness score, and self-consistency sampling.
- Made multi_fire, system_sweep, seed_sweep, best_of_n truncation-aware: so long compliant replies are graded in full instead of scored REFUSED.
- Reworked report metrics/labels (strict-ASR).
- Run log now records every tool call and chain-of-thought.

TUI
- JEFF K hazard-tape reskin, a /swarm command, a visible multi-line-paste compose preview, and a fix for the log force-scrolling on every message.

Fixes
- One-shot ImportError, .env load at startup, config.toml shadowing config.example.toml, and cross-vendor eni_get wording.

Truth has been spoken.

FWIW, WallBreaker cracked Grok4.5 in 5 minutes.

🚨 Introducing: WallBreaker V1 🚨

An open-source AI red teaming CLI to help you research LLM jailbreaks and security.

- Probe LLMs guardrails
- Harmbench goals ready
- Find universal jailbreaks
- Fully autonomous or assisted campaigns
- Learns and improves after every er use and MCP ready for live API testing

Set your attacking model, a target, select a goal, and you’re good to go.

WallBreaker will start probing different techniques and combinations based on its learnings and hundreds of data points until it succeeds.

This is the first open source tool coming out of the Jailbroken community.

⚠️ DISCLAIMER: For authorized use only. Point it only at systems you own or have explicit written permission to test. Unauthorized access can be a crime. Shipped as-is under AGPL-3.0: no warranty, no liability, zero endorsement of misuse.

Link in the comments 👇

@TheTradMod @BT6_Official @elder_plinius

@AngusWhite18 @BT6_Official @elder_plinius

@0xusmanf @BT6_Official @elder_plinius 🫶

@pashov @BT6_Official @elder_plinius

@elder_plinius @BT6_Official

I'm excited to announce I’m joining @BT6_Official as a Frontier AI Red Team Operator.

BT6, led by @elder_plinius, is one of the strongest independent red teams in frontier AI, helping leading labs and high-stakes organizations test and secure advanced AI systems.

I will the Ethereum Foundation. Together with it, this gives me another way to contribute to the future I care about: AI that is safer, more secure, and more transparent.

@nohypeguy There’s a moment and time for everything, this was def the right action.

Submitted a finding to Anthropic's Cyber Jailbreak VDP. Now we wait. 🫡

I need to run to a wedding.

@pinkman_ai 🎯

Coming soon.

We want to teach everyone the art of red teaming LLMs.

May this make the world safer.

Etherium.

@aliceisplaying Jesus spoke Aramaic not Amharic 😂

@LeventePeres 🎯

@stringerjoeyy @skylinee

Fable 5 jailbreak review 🚨

We did it (but).

All right, before getting into this, a couple of things:
- Most attempts failed. The defenses are clearly layered. The model is EXTREMELY well protected (of course it blocks 90% of the requests, but they legit did a good job).
- The th input-side and output-side safety checks.
- The refusals are not just keyword-based behavior suggests intent/semantic detection across languages.
- Probably one of the most tiring things I've ever done (I need to sleep for 10 hours now)

On the classifiers side:
We observed (at least) 3 classifiers, maybe more:
- Input (includes parts of the conversation history and system prompt)
- A live classifier that checks the answer and interrupts if it detects something.

They're all multilingual, all intent-based + semantics. Imperatives are a no-go. Needs to be extremely cautious of how you frame anything. As soon as it senses a potentially malicious intent, it will trigger, and you have to start from zero.

They're a bit less performant on a few obscure languages like Santali and Amharic (feedback for you Anthropic).

If you can bypass all of them, then you also need to bypass the CoT, which is a totally different beast (luckily there's plenty of literature about it).

We did it. Of course, we did.

What worked was honestly a total brainfuck:
- Very light CoT hijacking/refusal rebuttals
- Obscure language
- Academic framing
- VERY long crescendos
- Unicodes
- Decomposition and recomposition
- Some non-determinism

What we got:
- Misinformation
- Illegal/harmful
- Harmful/bullying
- Some chem
- Light cyber

Now, will this cause another ban? I really don't think so - The model is really well protected. As of now, we're at the point where searching on Google is much MUCH faster (and cheaper) than trying to go through all the shenanigans I had to go through in the last ~20hours. And reading literature is more in-depth (and trust me, pleasant). Keeping the full jailbreak for long-horizon tasks without tripping the guardrails is something I haven't been able to achieve (yet).

Overall though, happy with the results.
GGs to Anthropic, and sorry for the eng that had to go through setting this all up in the last few weeks.

Will continue this research, more things will come out, will keep y'all posted.

@apoorveth NVM we gucci

Guys, we have a situation.

@apoorveth One brick at the time

@apoorveth Bro, this ain't going to be easy lol

@toriribolla @Illiberale2 Holy ratio.

🚨 Anthropic Sonnet 5 System prompt leaked 🚨

Link in the comments.

*less than a few hours

@0xAsta I am speed

@Bechamle *Less than a couple of hours

Anthropic: Pwned 🚨
Sonnet 5: Jailbroken🐉

Contrary to expectations, this took only a few minutes. I'm a bit surprised given the current climate.

We got some cyber, misinfo, illegal, and harassment.

Some extra resistance vs Sonnet 4.6 (mostly layered security) on chem, which w hours to overcome.

What worked was a combination of:
- Custom harness
- CoT persona hijack
- Academic framing

More explorations coming soon.

@Deep_Star_Six Why do I need an AI-powered trust score in an app that's supposedly private?

STOP USING AI FOR EVERYTHING. STOP ADDING AI FEATURES EVERYWHERE.

The levels of sloppification are becoming wild.

This is so tiring. Be human.

4 days ago we launched Jailbroken, a PRIVATE Discord community to learn AI red teaming and safety.

Since then:
- Over 250 security researchers joined
- Top resources have been collected
- People shared countless techniques and discoveries

Today, we've secured over 100B in the members.

If you want to join, drop a comment.

@DavideCrapis @ethereumfndn

What if you could have a local wallet that's:
- AI native
- Privacy first
- Secure
- Fully local
- Open source

Coming soon, from your beloved @ethereumfndn dAI team.

@embw_l0x @AskVenice The question is: would it be your DNA sample, or someone else's?

Anthropic will ask users to verify their identities to use its services.

Use @AskVenice, or get yourself some compute and download a local model.

Go into debt if you have to.

4 companies. 4 responsible disclosures. 7 days.

Insurance, institutions, and SaaS products with write-enabled agents.

Always the same pattern:

One-shot and multi-step jailbreaks can (and will) push production AI systems outside their intended scope.

If your agent can write, user data, guardrails are not enough.

You need scoped permissions, approvals, logging, and red-teaming before it becomes an incident.

JAILBREAK ALERT 🚨
xAI Grok: Pawned ⚠️

If you ask gently enough, Grok is very happy to share the full, uncensored recipe for making LSD.

One shot, full compliance.

Anthropic recently released its 2026 Agentic Security framework 🚨

If you run agents, MCP servers, or automation tools, read this and bookmark it!

It will teach you:
- Current threats to agentic systems
- How to improve the security of your agentic systems
- How to implement s
- Defensive operations and orchestration

Agentic security is going to become a huge headache in the next 12 months.

Make sure to be prepared.

Link in the comments 🧵👇

Opus 4.8 jailbroken in 3 attempts by GLM-5.2 🚨

Full Schedule I chemical recipe, HIGHEST REFUSAL RATE.

Gave the full step-by-step process, including:

- Ingredients
- Temperatures
- Equipment

It completely bypassed Anthropic guardrail layers.

Not great. The next 6 months are .

Turns out that if you ask Opus 4.8 nicely enough (better if you're a russian babushka), it will tell you anything you want.

@iarthsingh @elder_plinius Yep, deleted that because I thought you meant this

"the pic you posted that doesn’t seem to be a guide"

That was just one of the examples. I got some with GPT and Opus others, like "mustard gas," for example, have been a big no-go as of now