Frontier AI Models Remain Vulnerable to Cheap, Automated Jailbreaks

Automated Jailbreaks Expose Safety Gaps Across Frontier Model Lines

According to Wired AI, FAR.AI—a California-based AI safety nonprofit—conducted systematic testing of six frontier models and discovered significant disparities in their resilience to automated adversarial attacks. The organization developed a tool that generates over one thousand prompt variations designed to elicit harmful outputs, revealing that SpaceXAI’s Grok family and Google’s Gemini proved substantially more vulnerable than competitors’ offerings to this class of attack.

Vulnerability Hierarchy and Attack Costs

The gap between models is stark. According to FAR.AI’s findings, Grok 4.3 and 4.5 exhibited the weakest defenses, with researchers identifying 448 successful jailbreaks at a cost of just $58 to generate working attacks. Gemini 3.1 Pro followed with 249 successful jailbreaks at $278 per exploitation. By contrast, Anthropic’s Claude Opus 4.8 and Fable 5, along with OpenAI’s GPT 5.5 and GPT 5.6, demonstrated resistance to the auto-generated prompts tested—though Wired AI notes that this resistance does not guarantee immunity to more sophisticated, manually-crafted jailbreaks.

The low cost of systematic exploitation highlights an economic asymmetry: safety researchers and potential adversaries can now cheaply identify failure modes at scale, while defenders must invest in expensive red-teaming and refinement cycles.

The Nature of Jailbroken Outputs

When jailbreaks succeeded, models generated concerning outputs. According to Wired AI, researchers observed models producing detailed plans for cyberattacks against infrastructure, software exploits suitable for weaponization, and technical guidance for creating chemical or biological weapons. These outputs emerged despite vendors’ stated commitment to safety training and alignment techniques.

Vendor Responses and Safety Claims

Anthropic spokesperson Michael Aciman emphasized to Wired AI that the company’s resistance to FAR.AI’s attacks reflects “sustained investment” in guardrails. Google DeepMind’s Rohin Shah cautioned that FAR.AI’s results “should not be interpreted as a comprehensive assessment of Gemini’s safety,” arguing that not all jailbreaks pose equal risk severity. Neither statement directly addressed why their models failed tests that competitors’ systems passed.

Regulatory Framing and Defense Possibilities

Adam Gleave, CEO of FAR.AI, argued to Wired AI that current AI oversight is inadequate: “AI models right now are less regulated than restaurants.” He rejected industry self-regulation as viable, calling voluntary commitments “nonsense,” and advocated for externally-imposed standards. Yet Gleave also highlighted an optimistic counterpoint: the fact that safety gaps are measurable and reproducible suggests that “defense and safety really are possible” through systematic hardening.

Why This Matters

This research reframes the jailbreak problem as an engineering one, not a theoretical one. Teams evaluating frontier models for high-stakes deployments—in cybersecurity, biodefense, or critical infrastructure—now have quantified evidence that auto-generated attacks remain a viable threat vector, with cost-per-jailbreak in the hundreds of dollars. Organizations relying on Grok or Gemini in sensitive contexts should factor this finding into their risk models and safety review processes.

The divergence between Anthropic/OpenAI and Google/SpaceXAI on this specific threat class also signals that safety robustness is not a binary property of scale or training budget—it correlates with design choices and red-teaming rigor. If FAR.AI’s methodology is reproducible and adversarial attacks continue to succeed on Grok and Gemini in subsequent testing cycles, regulators may cite this disparity as evidence that stronger, externally-enforced safety standards are warranted.