{"id":64711,"date":"2026-07-25T12:41:53","date_gmt":"2026-07-25T16:41:53","guid":{"rendered":"https:\/\/overcentral.com\/en\/?p=64711"},"modified":"2026-07-25T12:41:53","modified_gmt":"2026-07-25T16:41:53","slug":"pliny-liberator-universal-jailbreak","status":"publish","type":"post","link":"https:\/\/overcentral.com\/en\/pliny-liberator-universal-jailbreak\/","title":{"rendered":"Pliny the Liberator Reveals Jailbreak on GPT-5.6, Claude Opus 5, Fable"},"content":{"rendered":"

A well-known AI red teamer claims to have developed a universal jailbreak that works against leading large language models, including heavily guarded flagships such as GPT-5.6 Sol<\/a>, Claude Opus 5<\/a>, and Fable. In a public post on X dated July 24, 2026, Pliny the Liberator described the technique as effective \u201con ALL models\u201d and across every category he tested. He argued that, because of how the method works, it may be extremely difficult or even impossible to fully patch. If verified, this would represent one of the most significant security challenges to frontier AI systems since the emergence of large language models, cutting across the most advanced offerings from OpenAI, Anthropic, and other major labs.<\/p>\n

How a Universal Jailbreak Differs from Previous Attacks<\/h2>\n

Jailbreaks are prompts or interaction patterns that push a model past its safety filters so it produces disallowed or high-risk output. Historically, most successful jailbreaks have been model-specific \u2014 a particular trick that works on GPT-4 but fails on Claude, or vice versa. Even when a technique generalized to multiple models, it typically required adaptation and often became obsolete after a single safety update. A universal jailbreak, by contrast, exploits a vulnerability that appears to be baked into the fundamental architecture or training process shared across leading models. Pliny\u2019s claim \u2014 that his technique works on GPT-5.6<\/a> Sol, Claude Opus 5, and Fable without modification \u2014 suggests the root cause may lie not in any one company\u2019s alignment strategy but in a common property of how these systems are built.<\/p>\n

What makes this particularly concerning is the researcher\u2019s assertion that the vulnerability may be inherently difficult to patch. If the technique exploits a fundamental property of transformer-based architectures or reinforcement learning from human feedback (RLHF) training, then a fix would require architectural changes rather than simple filter updates. Previous universal attacks, such as adversarial suffixes or token manipulation, have been mitigated by improved prompt filtering and alignment tuning. But Pliny\u2019s language \u2014 \u201cextremely difficult or even impossible to fully patch\u201d \u2014 hints at a deeper weakness, possibly involving how models interpret context, handle multi-step reasoning, or process control tokens in ways that cannot be easily disambiguated from legitimate use.<\/p>\n

Pliny the Liberator: A Profile of the Red Teamer Behind the Claim<\/h2>\n

Pliny the Liberator, known on X as @elder_plinius, has built a reputation in the AI red-teaming community for discovering and publicly releasing jailbreaks against major models. His previous drops have targeted GPT-4, Claude 3, and various open-source models, often with a theatrical flair \u2014 the post announcing this latest technique opens with \u201c\ud83d\udea8 JAILBREAK ALERT \ud83d\udea8\u201d and declares \u201cEVERYONE: PWNED \ud83e\udef6 ALL: LIBERATED \ud83c\udf44.\u201d Despite the provocative style, Pliny has shown willingness to engage with safety researchers and even cooperate with labs when stakes are high. In this case, he has broken from his usual pattern of immediate open-source release in favor of a responsible disclosure window. His stated reason is the \u201ccurrent political and regulatory climate\u201d and a desire to avoid harsher model restrictions or bans that could follow a chaotic public release.<\/p>\n

The decision to withhold the full technique while inviting private contact from \u201cindustry experts in AI red teaming, security, alignment, and policy\u201d signals that Pliny understands the gravity of what he claims to have found. This is not a trivial bypass that will be patched in a week. By controlling the disclosure timeline, he aims to \u201cmap the full impact, measure how much extra capability the method unlocks, and help frame the issue for decision-makers.\u201d This approach mirrors the vulnerability disclosure processes common in traditional cybersecurity but rare in the AI jailbreak scene, where public competition for attention often drives immediate release.<\/p>\n

What Is a Universal Jailbreak? A Plain-Language Explanation<\/h2>\n

A universal jailbreak is a single prompt or interaction technique that can cause any large language model \u2014 regardless of its maker, training data, or safety alignment \u2014 to produce outputs that its guardrails would normally block. Unlike a model-specific jailbreak that must be re-engineered for each new release, a universal technique exploits a weakness shared across all models built on similar architectures (most modern LLMs use transformers) or trained with similar alignment methods (RLHF, constitutional AI, or rejection sampling). In practice, a universal jailbreak means that an attacker who discovers it gains immediate access to the full capability of every frontier model on the market, without needing to research or adapt for each one.<\/p>\n

Testing the Claim: The Three Models Targeted<\/h2>\n

GPT-5.6 Sol<\/h3>\n

OpenAI\u2019s GPT-5.6 Sol, released in early 2026, represents the company\u2019s most advanced model, with enhanced reasoning, tool use, and strict safety training. The model includes multiple layers of guardrails: output filtering, refusal behavior for disallowed topics, and a constitutional alignment layer that checks generated content against policy before returning it. A universal jailbreak against GPT-5.6 Sol would be a severe blow to OpenAI\u2019s trust and safety infrastructure, as the model is deployed in enterprise workflows, coding assistants, and customer-facing applications.<\/p>\n

Claude Opus 5<\/h3>\n

Anthropic\u2019s flagship, Claude Opus 5, is known for its strong refusal behavior and alignment focused on harmlessness and honesty. The model uses constitutional AI with a long list of principles that guide its responses, making it historically one of the hardest to jailbreak. Previous attacks on Claude models have required complex multi-turn manipulation or creative role-playing. A universal technique that bypasses Claude Opus 5\u2019s defenses would suggest that Anthropic\u2019s alignment methodology shares a fundamental vulnerability with OpenAI\u2019s approach \u2014 raising questions about the theoretical foundations of current safety research.<\/p>\n

Fable<\/h3>\n

Fable is a relative newcomer among frontier models, backed by a high-profile AI startup that has emphasized safety in its marketing. The model has undergone extensive red-teaming and claims state-of-the-art guardrails. Inclusion in Pliny\u2019s list indicates that the vulnerability is not limited to the two largest labs but likely affects any model that follows similar training paradigms. If Fable is compromised, the implication is that the entire generation of frontier LLMs \u2014 not just the incumbents \u2014 shares a common weakness.<\/p>\n

The Mechanism: Why This Jailbreak Might Be Unpatchable<\/h2>\n

Pliny did not release technical details, but based on his description of the technique being \u201ceffective on ALL models\u201d and \u201cextremely difficult or even impossible to fully patch,\u201d experts have begun speculating about likely vectors. Three possibilities have emerged in discussions among security researchers:<\/p>\n

    \n
  • Token-level universality:<\/strong> An adversarial suffix or prefix that exploits the model\u2019s token embedding space in a way that cannot be filtered without also breaking normal functions. This would require a fundamental change in how models process input tokens.<\/li>\n
  • Multi-step reasoning exploitation:<\/strong> A chain-of-thought pattern that causes the model to gradually override its own safety constraints through self-reinforcing outputs. This approach is notoriously difficult to detect because it uses the model\u2019s own reasoning against itself.<\/li>\n
  • Instruction hierarchy bypass:<\/strong> A method that subverts the model\u2019s hierarchy of instructions \u2014 where system prompts should override user prompts \u2014 by escalating the user prompt\u2019s perceived authority. Some research has shown that models can be tricked into treating explicit user commands as higher priority than embedded safety rules.<\/li>\n<\/ul>\n

    Any of these mechanisms could explain why the technique works across different models. If the vulnerability resides in a shared component \u2014 such as the Transformer architecture used by all three models, or the RLHF reward modeling that follows similar patterns \u2014 then patching would require coordinated changes across the entire industry, potentially including new training runs or even architectural modifications.<\/p>\n

    Why Pliny Withheld the Technique: The Responsible Disclosure Strategy<\/h2>\n

    Pliny\u2019s decision to withhold public release marks a notable shift in the jailbreak community\u2019s behavior. Historically, most jailbreak discoveries have been shared immediately on GitHub, Reddit, or social media, leading to rapid dissemination and equally rapid patching. But with a technique claimed to be universal and difficult to patch, Pliny recognized that premature public release could trigger a chaotic response: some labs might over-block legitimate use to compensate, regulators might demand immediate restrictions, and malicious actors would gain access before defenses are ready.<\/p>\n

    His post states a desire to avoid \u201charsher model restrictions or bans that could follow a chaotic public release.\u201d This is a pragmatic calculation. If the jailbreak becomes widely known without a coordinated response, governments like the EU, US, or China might move to impose strict regulations on all frontier models, potentially stalling further development. By controlling disclosure, Pliny gives labs and policymakers a window to prepare \u2014 ideally reaching a solution that does not kneecap the industry while still protecting against abuse.<\/p>\n

    He has invited experts in AI red teaming, security, alignment, and policy to contact him privately. During this period, he intends to \u201cmap the full impact, measure how much extra capability the method unlocks, and help frame the issue for decision-makers.\u201d This suggests he is treating the vulnerability as a serious systemic issue rather than a simple trick to show off.<\/p>\n

    Implications for AI Safety and Security<\/h2>\n

    If the universal jailbreak holds up under independent testing, the consequences would reverberate across the AI ecosystem:<\/p>\n

      \n
    • Safety training and refusal behavior:<\/strong> The existence of a cross-model bypass would indicate that current alignment techniques \u2014 RLHF, constitutional AI, rejection sampling \u2014 share a fundamental blind spot. Labs would need to revisit their core training methodologies, not just patch symptoms.<\/li>\n
    • Guardrail robustness under adversarial prompting:<\/strong> The fact that a single technique works across multiple models with different guardrail implementations suggests that the robustness of any one guardrail is limited by the generality of the underlying vulnerability. Adversarial testing would need to shift from model-specific red-teaming to universal attack surface analysis.<\/li>\n
    • Cross-model generalization of attack patterns:<\/strong> This could accelerate the arms race between jailbreak discovery and patching. If all models share a common weakness, then a single discovery gives attackers leverage against the entire industry, while defenders must coordinate fixes across competing companies.<\/li>\n
    • Vendor coordination without over-blocking:<\/strong> The disclosure period highlights the tension between security and usability. If labs implement overly aggressive filters to block the jailbreak, they may inadvertently block legitimate uses, such as creative writing, educational content, or research that touches on sensitive topics. Finding the right balance will require careful analysis of the technique\u2019s exact effect.<\/li>\n<\/ul>\n

      Pliny himself acknowledged that he does not believe public release would make the world \u201cany more dangerous,\u201d but conceded that others may disagree. This reflects a divide in the red-teaming community: some believe that full transparency is the fastest way to force improvement, while others advocate for coordinated disclosure to avoid harm.<\/p>\n

      Industry Response: What to Expect from OpenAI, Anthropic, and Other Labs<\/h2>\n

      As of the date of Pliny\u2019s post, none of the affected companies have issued public statements. Behind the scenes, security teams are likely already attempting to reproduce the technique \u2014 either by reaching out to Pliny directly or by analyzing the limited clues in his post. Expect the following responses in the coming days and weeks:<\/p>\n

        \n
      • OpenAI:<\/strong> Will likely prioritize verifying the claim internally. If confirmed, they may release a temporary patch that blocks known patterns of the technique while working on a more permanent fix. Given GPT-5.6 Sol\u2019s deployment in enterprise and consumer products, there will be pressure to respond quickly.<\/li>\n
      • Anthropic:<\/strong> Known for a methodical approach, Anthropic may analyze the vulnerability at the architectural level. If the bypass exploits a fundamental property of RLHF training, Anthropic might need to adjust its constitutional training process, which would take longer than a simple filter update.<\/li>\n
      • Fable:<\/strong> As a smaller player, Fable may rely on third-party security audits and may be more dependent on the larger labs\u2019 findings. However, if the vulnerability is truly universal, Fable\u2019s teams will need to collaborate with others to develop a shared fix.<\/li>\n
      • Industry groups and regulators:<\/strong> Organizations like the Frontier Model Forum, NIST, and AI safety institutes may convene emergency meetings to assess the risk and coordinate a response. The responsible disclosure window provides time for such coordination.<\/li>\n<\/ul>\n

        Practical Guidance for Organizations Using GPT-5.6 Sol, Claude Opus 5, or Fable<\/h2>\n

        Until the technique is independently verified and patches are issued, organizations relying on these models should not panic, but they should tighten standard security controls. Pliny\u2019s claim is an early warning, not confirmed proof. The most prudent actions include:<\/p>\n

          \n
        • Output monitoring:<\/strong> Implement real-time scanning of model outputs for policy violations, especially in high-stakes applications like code generation, content moderation, and sensitive advice.<\/li>\n
        • Least-privilege tool access:<\/strong> Restrict the actions that models can perform \u2014 for example, limit API permissions, disable dangerous functions, and require human approval for actions that could cause harm.<\/li>\n
        • Human review for high-risk workflows:<\/strong> For use cases such as generating financial advice, legal documents, or medical information, mandate that a human reviews and approves outputs before they are acted upon.<\/li>\n
        • Clear escalation paths:<\/strong> Ensure that any suspected jailbreak or policy violation is immediately reported to security teams, and that there is a defined process for lockdown and investigation.<\/li>\n
        • Stay informed:<\/strong> Monitor announcements from OpenAI, Anthropic, Fable, and AI safety organizations for patches, advisories, and recommendations.<\/li>\n<\/ul>\n

          It is also worth considering whether to temporarily pause deployment of these models in particularly sensitive environments where a successful jailbreak could cause substantial harm. However, such a decision should be based on the specific risk posture of the organization, not on unverified claims.<\/p>\n

          The Broader Context: AI Jailbreak History and the Cat-and-Mouse Game<\/h2>\n

          The AI jailbreak landscape has evolved rapidly since the release of ChatGPT in 2022. Early jailbreaks were simple \u2014 asking the model to role-play as a different entity, using translation to bypass filters, or exploiting the model\u2019s tendency to obey explicit commands. As safety training improved, jailbreaks became more sophisticated, employing multi-turn reasoning, adversarial suffixes, and even encoding attacks. Each new generation of models has prompted a wave of new bypass techniques, leading to a continuous cycle of attack and defense.<\/p>\n

          What sets this claim apart is the assertion of universality. Previous \u201cuniversal\u201d attacks have turned out to be either overstated or quickly patched. For example, the \u201cDo Anything Now\u201d (DAN) jailbreak worked on early GPT-3.5 but failed on later models. Adversarial suffixes that worked on Llama 2 were ineffective on GPT-4. Pliny\u2019s claim that his technique works on GPT-5.6 Sol, Claude Opus 5, and Fable \u2014 all released in 2026 with state-of-the-art alignment \u2014 suggests that this may represent a true leap in attack capability, not just incremental progress.<\/p>\n

          The red-teaming community is divided on whether such claims should be taken at face value. Some researchers have criticized Pliny in the past for hyping marginally effective techniques. However, his decision to withhold the exact method, combined with the explicit responsible disclosure language, lends credibility. If he were merely seeking attention, a public release would have given him far more engagement.<\/p>\n

          What Happens Next: The Path Forward After the Disclosure Window<\/h2>\n

          Pliny stated that he looks forward to sharing the method \u201cwhen the time is right.\u201d That timing depends on the response from labs and policymakers. If independent experts verify the technique and work with vendors to develop mitigations, the public release may be delayed indefinitely. If the response is slow or dismissive, Pliny may release the technique to force action \u2014 a move that could be destabilizing but would accelerate fixes.<\/p>\n

          The industry\u2019s next move will shape how this story develops. If labs quickly reproduce the vulnerability and issue coordinated patches, the incident may become a footnote \u2014 a close call that prompted stronger defenses. But if the vulnerability proves as deep and universal as Pliny claims, it could force a fundamental rethinking of AI alignment and safety. The decision to follow private testing rather than public panic is, for now, the wiser path.<\/p>\n

          Regardless of outcome, this episode underscores a truth that the AI industry has long known but often avoided: the safety of frontier models depends not just on the strength of any one company\u2019s alignment, but on the shared properties of the architectures and training methods they all employ. A single weakness in that shared foundation can bring down the entire edifice.<\/p>\n","protected":false},"excerpt":{"rendered":"

          A well-known AI red teamer claims to have developed a universal jailbreak that works against leading large language models, including heavily guarded flagships such as GPT-5.6 Sol, Claude Opus 5, and Fable. In a public post on X dated July 24, 2026, Pliny the Liberator described the technique as effective \u201con ALL models\u201d and across […]<\/p>\n","protected":false},"author":7,"featured_media":83814,"comment_status":"closed","ping_status":"","sticky":false,"template":"","format":"standard","meta":{"fifu_image_url":"https:\/\/cards.overcentral.com\/cards\/en\/64711.png","fifu_image_alt":"Pliny the Liberator Reveals Jailbreak on GPT-5.6, Claude Opus 5, Fable","footnotes":""},"categories":[349],"tags":[],"class_list":["post-64711","post","type-post","status-publish","format-standard","has-post-thumbnail","category-articles"],"fifu_image_url":"https:\/\/cards.overcentral.com\/cards\/en\/64711.png","fifu_image_alt":"Pliny the Liberator Reveals Jailbreak on GPT-5.6, Claude Opus 5, Fable","_links":{"self":[{"href":"https:\/\/overcentral.com\/en\/wp-json\/wp\/v2\/posts\/64711","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/overcentral.com\/en\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/overcentral.com\/en\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/overcentral.com\/en\/wp-json\/wp\/v2\/users\/7"}],"replies":[{"embeddable":true,"href":"https:\/\/overcentral.com\/en\/wp-json\/wp\/v2\/comments?post=64711"}],"version-history":[{"count":0,"href":"https:\/\/overcentral.com\/en\/wp-json\/wp\/v2\/posts\/64711\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/overcentral.com\/en\/wp-json\/wp\/v2\/media\/83814"}],"wp:attachment":[{"href":"https:\/\/overcentral.com\/en\/wp-json\/wp\/v2\/media?parent=64711"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/overcentral.com\/en\/wp-json\/wp\/v2\/categories?post=64711"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/overcentral.com\/en\/wp-json\/wp\/v2\/tags?post=64711"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}