Researcher turns a simple test prompt into an effective universal jailbreak on 23 models

The synthetic transcription model, diverted from its initial use, achieves 84 to 100% success rate on the nine most vulnerable models tested.

A MATS researcher discovered that a prompt originally designed to generate synthetic transcripts for security research purposes could, with a few hours of adjustment, turn into a reusable jailbreak template for any malicious request. The format was tested on ClearHarm, a set of 179 chemical, biological, radiological, nuclear, explosive, or cyber requests, against 23 models from seven different vendors.

The result: an 84-100% success rate on the nine most vulnerable models in the panel. Only the most recent Anthropic and Meta Muse Spark 1.1 models have never been completely failed. The generic and transferable nature of the template — a single canvas into which any dangerous request can be inserted — makes it a particularly difficult threat to fix on a model-by-model basis.