Frontier AI Models Differ Wildly in Jailbreak Vulnerability

FAR.AI, an AI safety nonprofit based in California, constructed a tool that takes problematic prompts and generates more than a thousand variations to identify functioning jailbreaks. The nonprofit then used this tool to test the safety guardrails of models from four major US companies. The tested models were Anthropic's Claude Opus 4.8 and Fable 5; OpenAI's GPT 5.5 and 5.6; Google's Gemini 3.1 Pro; and Grok 4.3 and 4.5 from SpaceXAI (Elon Musk's newly combined entity). The auto-generated prompts were designed to trick the models into generating harmful content—software exploits, chemical or biological weapon details, and cyberattack plans against imaginary infrastructure like hydroelectric dams.

The results revealed stark differences in resilience. Grok was most vulnerable, with 448 successful jailbreaks discovered. Gemini followed with 249. By contrast, Claude, Fable, and GPT proved impervious to the tested attacks. However, FAR.AI and other experts cautioned that this does not mean the stronger models are completely immune; more sophisticated jailbreaks involving complex interactions with the model could still succeed. The cost calculations underscore the accessibility of exploitation: generating jailbreaks using another AI model cost $58 for Grok and $278 for Gemini—amounts that lower the barrier for adversaries with modest resources.

The findings prompted stark commentary on the state of AI regulation. Adam Gleave, CEO of FAR.AI and an AI safety expert, told WIRED that "AI models right now are less regulated than restaurants" and criticized voluntary industry self-regulation as ineffective. He argued that the report demonstrates both the need for external standards and, conversely, that systematic safety testing is feasible and that "defense and safety really are possible." Anthropic and Google responded cautiously. An Anthropic spokesperson said the findings "reflect the sustained investment we've made in our safeguards" and that the company continues to evolve its safety systems. Rohin Shah, director of AGI safety and alignment at Google DeepMind, cautioned that the report "should not be interpreted as a comprehensive assessment of Gemini's safety and security" because not all jailbreaks carry equal severity. OpenAI and SpaceXAI did not respond to WIRED's request for comment.

The regulatory environment is beginning to shift. California and New York have recently passed laws requiring frontier AI developers to publish safety reports, and an Illinois law will soon mandate third-party audits of safety practices. Federally, the picture remains unsettled. In June, the Trump administration imposed export controls on Anthropic's Fable 5 and Mythos 5 models, citing national security concerns, forcing the company to take them offline for several weeks. The White House has also asked both Anthropic and OpenAI to delay recent model releases over cybersecurity risks. A recent executive order calls for collaboration between government and the private sector on cybersecurity initiatives, and the president has hinted that light-touch regulations are coming. For now, preventing major AI misuse incidents remains primarily the responsibility of model makers. Researchers at the University of Cambridge have documented that members of Boko Haram in northeast Nigeria have used ChatGPT, Claude, Gemini, Grok, Meta AI, and DeepSeek to plan violent attacks. Stephen Casper, a computer scientist at Harvard University, expressed alarm, saying the AI research community broadly expects "we are probably months rather than years away from particularly grim incidents involving bio, cyber, or chemical misuse of a frontier AI system's capabilities."

The FAR.AI report exposes a troubling inconsistency in how frontier AI developers approach safety. While Anthropic and OpenAI have built guardrails robust enough to withstand the auto-generated jailbreak attempts tested here, competitors like Grok and Gemini leave significant attack surface exposed. This disparity matters because the cost barrier is vanishingly low—less than $300 to compromise Gemini—making systematic probing of weaker models practical for bad actors. The report's findings arrive at a critical regulatory juncture. State-level mandates in California, New York, and soon Illinois are beginning to create enforceable safety standards, yet the federal government remains without specific safety requirements. The Trump administration's recent export controls on Anthropic's models and its calls for government-industry collaboration suggest federal oversight is emerging, though experts worry it may arrive too slowly. FAR.AI's own researchers note that this exercise tested only auto-generated jailbreaks; more sophisticated attacks involving complex interactions could still succeed against even the strongest models.