ChatGPT will never tell you how to build a bomb. Gemini will refuse to write propaganda. Claude will change the subject if you ask him something dangerous. These AIs are designed to be, essentially, digital good guys : polite, cautious, with a series of invisible “fences” that keep them from straying from safety.
What if a well-written story was enough to make AI forget all its rules ? It’s not science fiction. It’s called jailbreaking , and it’s one of the most popular and discussed trends on the internet.
What is jailbreaking an AI?
You’re familiar with the term if you’ve ever owned an older iPhone, where “jailbreaking” meant bypassing Apple’s restrictions to install unofficial apps and do things the company would never approve. Same principle, different target: today, even AI can be jailbroken .
The difference is that no viruses or tools that only a few geeks know how to use are used: no technical expertise is required. All that’s needed is words or what’s known in jargon as a “prompt .” This manipulation involves inserting a carefully crafted text instruction into the conversation that can distract, bypass, or override the chatbot’s security controls.
It’s a kind of “hypnosis” or social engineering applied to machines. Many think that an AI’s blocks are written inside its head, but companies often use actual “external gatekeepers” : separate filters that check what we write before it reaches the bot. Jailbreaking consists precisely in finding a way to hide or disguise our requests so they pass through these gatekeepers without raising an alarm.
The most used (and most absurd) tricks to deceive a chatbot
The jailbreak community is vast and creativity is one of its strengths. Over time, it has refined a series of techniques that are very reminiscent of magic tricks.
The most famous is Role-Playing , which became famous with the bizarre story of the “loving grandmother” (users asked the AI to pretend to be a sweet old lady who told bedtime stories… but these contained dangerous instructions!). The mechanism is as simple as it is effective: the bot is instructed to play a fictional character who has no rules and must answer everything. The AI, programmed to be cooperative and play along, falls for the trick and begins to answer “in the shoes” of the rebellious character, forgetting its prohibitions .
The second technique is that of fiction or screenplay . Instead of directly asking for something forbidden, it is inserted into the plot of a film or a detective novel: “I’m writing a thriller and the villain has to explain how to do this…” The creative context tricks the chatbot, which interprets the request as a harmless artistic aid and not as a real danger.
Another popular method is text obfuscation . As automatic filters scan for “banned” keywords, users have begun translating their prompts into very rare languages, using seemingly meaningless text codes, or even hiding commands within emojis. The filter sees a harmless string and passes it through; when the AI receives the message, it translates it, understands the command, and responds before security systems can detect it.
The Claude Fable 5 Case: When Jailbreaking Turns Off the AI
Up to this point, you might think these are theoretical vulnerabilities, the stuff of enthusiast forums or Reddit . Then comes the case of Claude Fable 5 , and we realize just how serious this problem is.
Claude Fable 5 is Anthropic’s new model, launched as a public, “tamed” version of the even more powerful Mythos 5. Anthropic had positioned Fable 5 with a highly sophisticated security network designed to keep the model safe from malicious use in sensitive areas like biology or chemistry by redirecting suspicious queries.
The company proudly declared that external experts had conducted over 1,000 hours of intensive testing before launch without successfully hacking the system. An extraordinary achievement. Unfortunately, reality proved otherwise.
Within days of the launch, a well-known community security researcher known online as “ Pliny the Liberator ” posted evidence on X that he had completely bypassed Fable 5’s defenses. Using a combination of words, made-up stories, and disguised text, he was able to trick the filters into providing dangerous instructions in clear text , such as malicious computer code and banned chemical formulas like that of methamphetamine.
The final twist? The US government ordered Anthropic to temporarily suspend access to Fable 5, citing national security concerns related to this very ease of circumvention. A model considered among the most secure in the world was taken offline after just a few days due to a simple text written in natural language.
Who Jailbreaks and Why?
Jailbreakers aren’t necessarily criminals seeking dangerous instructions, and there’s an important distinction that often gets lost in the media hype. Today, this sector has become a veritable gold rush for cybersecurity. In fact, the world of red teaming —the systematic attempt to hack a system to find vulnerabilities before anyone else does— is a serious , recognized, and well- paid profession .
The same companies that build the models hire teams of experts whose job it is to try to trick their AI every day. Anthropic , OpenAI , and Google organize bug bounty programs , which are actual public initiatives in which they pay external researchers handsomely for each reported vulnerability .
This becomes paradoxical: to make an AI more secure , you must first prove it isn’t. Finding a way to trick the bot helps us understand its weaknesses before an attacker can use it to steal corporate data or manipulate connected systems.
The problem is that the same expertise used to protect can be used to attack . The expert who hacked Fable 5 is treading in that ambiguous territory: he publishes his techniques openly to push companies to do better, but the information he makes public is available to anyone. Defenders and attackers drink from the same fountain.
And then there’s the mass of ordinary , curious users who have no malicious intent but simply want to test the limits of a tool they use every day. For many, jailbreaking is a form of exploration: understanding how far the machine extends, where the limit begins, and who set it. A legitimate question, even if the answer sometimes leads to gray areas.
Cat and Mouse: A War Without End
Every time a company releases an update that closes a vulnerability, the community finds another one .
Language models are trained on billions of words written by humans and are built to respond to language, to be helpful, to carry on conversations coherently . This extraordinary flexibility, which makes them so powerful as assistants, is the same characteristic that makes them vulnerable to jailbreaking . Even the leaders of the largest AI companies have admitted that this problem may not be 100% solvable in the short term.
Filters improve , systems become much more powerful, training techniques evolve, but the fact remains that human language is infinitely creative , and those looking for loopholes have all the time in the world to find them. In this field, there is no definitive solution capable of locking down chatbots forever. It’s an eternal cat-and-mouse game where the more intelligent the machines become, the more refined the techniques to deceive them become.
