Jailbreak

What it means

A jailbreak is a prompt, or a series of prompts, written to get an AI model to do something its builders trained it to refuse. Common tricks include role-play, hypothetical framing, splitting a request into harmless-looking steps, and encoding the request in another form.

OWASP treats jailbreaking as a form of prompt injection that gets the model to disregard its safety rules. The difference in practice is the target: a jailbreak aims at the model's own safety training, while other prompt injection aims at the instructions of the app built on top.

Why it matters

If your product gives people a chatbot, someone will try to push it off script. The harm can be mild, such as rude or off-brand replies, or serious, such as getting the model to reveal its hidden instructions or help with something harmful under your name.

The bigger risk is trusting the refusal as a security control. A model that usually declines a request will, with enough attempts, sometimes agree. Anything that matters, such as who may see which record, must be enforced by your code (see excessive agency), not by the model's good manners.

How it shows up

You meet jailbreaks in customer-facing chatbots, coding assistants, search helpers and agents. Attackers share working prompts openly, and new versions follow each model update. A system prompt that says never reveal this is a request, not a lock. Treat the model as a talkative helper, not a gatekeeper.

Defence is layered. Keep sensitive data and powerful tools out of reach of the model unless the signed-in account is allowed to use them. Check outputs before they reach a user or another system. Log conversations for review within your privacy rules. Test your own bot with known jailbreak styles before release, and again after model changes.