Jailbreak techniques now target AI agents through context and logic

At a glance

What this is: This is a research blog on emerging LLM jailbreak techniques that bypass safeguards by abusing policy-like prompts, tokenization tricks, distraction, and temporal reasoning.

Why it matters: It matters because identity and access teams now have to treat agent input, context flow, and tool delegation as security boundaries, not just model prompts.

Context

AI jailbreaks are not just bad prompts. They are manipulations of how a model interprets policy, structure, timing, and context, which means the failure sits in the control assumptions around the model rather than in one single filter.

For identity teams, the important shift is that these techniques become materially more dangerous once LLMs are embedded in agent workflows, MCP-connected tools, and enterprise copilots. At that point, unsafe model output can turn into governed action, not just text.

Pillar Security’s article frames the problem as an escalation from prompt abuse to context engineering. That is an atypical but increasingly realistic condition for organisations moving from assistant-style AI toward operational agentic systems.

Key questions

Q: What breaks when LLM jailbreaks are treated as simple prompt filtering failures?

A: Prompt filtering fails because many jailbreaks do not rely on explicit banned words. They exploit policy simulation, tokenization quirks, distraction, and temporal framing to change how the model interprets the input. In agentic systems, the result is worse than unsafe text: manipulated context can flow into tools and become action.

Q: Why do jailbreaks become more dangerous in agentic AI workflows?

A: They become more dangerous because the model is no longer the endpoint. Once the output can influence memory, APIs, or delegated tools, a successful jailbreak can move from unsafe language to unsafe execution. The security impact is amplified when context is reused across steps and no boundary exists before action.

Q: What are the signs that an AI guardrail is failing under jailbreak pressure?

A: Common signs include repeated refusals to explicit attack phrasing, followed by success when the same request is wrapped as formatting or workflow output. Another warning sign is a guard that describes allowed transformations too clearly, because that can expose a side channel. If the model can still emit the secret in pieces, the control is not holding.

Q: How should teams govern context and tool access in agentic systems?

A: Teams should treat context, memory, and tool reach as part of the access model. A model that can read untrusted content should not automatically inherit authority to call sensitive tools, reuse prior context, or continue execution after trust has changed. That boundary has to be explicit.

Technical breakdown

Policy simulation attacks and prompt structuring

Policy Puppetry and similar jailbreaks work by making malicious instructions look like legitimate configuration. Attackers mimic XML, JSON, INI, or policy-style markup so the model treats adversarial content as higher-priority instruction rather than user input. The trick is not format perfection, but enough structural resemblance to trigger the model’s learned pattern matching. That makes the attack resilient against simplistic keyword filters. In agentic environments, the risk increases because the same malformed instruction can move from a chat surface into a tool call, a memory layer, or an orchestration step. The core failure is instruction hierarchy confusion, where the model accepts user-authored policy as if it were governing policy.

Practical implication: validate and segregate policy-bearing inputs before they can influence agent execution paths.

Tokenization confusion and classifier bypass

TokenBreak-style attacks exploit the gap between what a classifier sees and what the model infers. By modifying token boundaries with extra characters, spacing, or other encodings, the attacker can cause a safety filter to see harmless fragments while the model still reconstructs the intended malicious meaning from broader context. This is especially important because many guardrails operate at the classification layer, not the semantic layer. Once the classifier mislabels the input, the model receives a green light it should never have had. In practice, this is less about one bad parser and more about a boundary mismatch between token-level detection and context-level interpretation.

Practical implication: test guardrails against semantic obfuscation, not only exact-match toxic phrases.

Context engineering in agentic systems

The most consequential shift is not the jailbreak technique itself, but where it lands. When LLMs sit inside agent workflows, tool chains, and MCP-connected systems, a single successful jailbreak can propagate across memory, APIs, and delegated actions. The article’s examples show that attackers can use distraction, fallacious reasoning, or temporal framing to push the model past its safety posture and into downstream execution. That means the real control plane is no longer just model output moderation. It is the chain of context, memory, tool privilege, and execution timing that determines whether a prompt becomes an action.

Practical implication: govern tool delegation and context inheritance as part of AI identity and access design.

Threat narrative

Attacker objective: The attacker wants the model to override its own safeguards and generate or execute unsafe actions that are later consumed by connected agent systems.

1. Entry occurs when an attacker supplies a crafted prompt, document, screenshot, or policy-like payload that enters the model’s context through a normal user or tool channel.
2. Escalation occurs when the model misreads the input as policy, legitimate instruction, or benign context and starts to follow the attacker’s intended frame instead of the system’s safety rules.
3. Impact occurs when the model produces unsafe output or passes malicious instructions into agent workflows, where the result can be tool misuse, unsafe command execution, or broader logic failure.

Breaches seen in the wild

• DeepSeek database exposure 2025: An unauthenticated DeepSeek ClickHouse database exposed over a million log lines with plaintext chat history and API keys in 2025.
• reviewdog Action compromise 2025: A stolen maintainer token poisoned reviewdog/action-setup, leaking CI secrets including the tj-actions bot token used in the next attack.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Language has become an attack surface, not just an input channel. These jailbreaks succeed because models are trained to infer meaning from structure, tone, and context, and attackers now weaponise that behaviour. Once policy-looking text, temporal framing, or distraction can redirect model interpretation, classic content filters stop being sufficient. Practitioners should treat language handling as a governed control plane, not a text moderation problem.

Executable logic is the right concept for understanding modern jailbreak risk. The article shows that prompts can function like instructions, policies, and execution hints once they enter agentic systems. That means the security boundary is no longer only code or API calls; it is also the semantic path from input to tool action. The implication is that agent governance must cover how context becomes authority, not just how tokens are classified.

Context collapse is the failure mode that makes agentic jailbreaks materially different from chat abuse. In a standalone chatbot, unsafe output may stay textual. In an agent workflow, the same output can influence memory, tool use, and delegated execution, which collapses the distance between prompt and action. That is why the most important risk is not model error rate but untrusted context acquiring operational effect. Security teams should treat context inheritance as a privileged pathway.

Policy simulation attacks expose a control assumption that many AI programmes still rely on. Safety controls were designed for systems where policy is external to the user prompt and execution is mediated by fixed application logic. That assumption fails when attackers can present user text as if it were governing policy and the model then follows it. The implication is that AI governance has to separate policy authority from content appearance.

AI agent security now needs a control model that spans model, memory, and tool privilege. The article’s examples repeatedly show that the weak point is not one safeguard in isolation but the interaction between classifiers, reasoning, and delegated action. Organisations that only assess prompt filters will miss the actual failure chain. Practitioners should govern the full input-to-action path as one identity and access problem.

From our research library:

• 88% of organisations have embedded AI agents in their workflows, according to KPMG's 2026 report.
• Read next: Agentic AI Security Guide

What this signals

Context inheritance is now a security control surface: when a model can carry untrusted text forward into memory or tool execution, the risk is no longer contained at the prompt. Security programmes should decide which inputs are allowed to persist, which can influence tools, and which must be quarantined before they become operational context.

Agentic AI systems need controls that assume language can carry authority. That means access decisions, tool permissions, and output handling must be evaluated together rather than as separate layers, because jailbreaks exploit the seams between them.

For practitioners

• Test jailbreak resistance against semantic obfuscation Run red-team cases that use policy-like markup, leetspeak, token boundary manipulation, distraction, and temporal framing to see whether the model still leaks unsafe instructions or tool actions.
• Separate policy authority from user content Ensure system policies, guardrails, and tool instructions are stored and enforced outside the user-controlled prompt surface so attacker text cannot masquerade as governance.
• Treat context inheritance as privileged Review what prior messages, documents, screenshots, memory objects, and tool outputs can influence an agent before they are allowed to steer execution.
• Constrain delegated tool execution Limit which tools an agent can reach after untrusted context is detected, and require explicit trust boundaries before any downstream action is taken.

Key takeaways

• LLM jailbreaks now work by abusing structure, context, and reasoning rather than relying on classic software exploitation paths.
• The article’s examples matter because unsafe model behaviour can propagate into agent workflows, where a prompt becomes an action.
• Teams need controls that separate untrusted language from policy authority and tool execution, or jailbreaks will keep bypassing conventional guardrails.

Key terms

• Policy Simulation: Policy simulation is the practice of making malicious instructions look like legitimate governance text, such as configuration files or rules. It works by exploiting the model’s tendency to trust structured context, which can override the protections that would normally apply to user requests.
• Tokenization Confusion: A bypass method that alters how text is split into tokens so a classifier misreads the content while the model still infers the intended meaning. In agentic environments, that mismatch can let harmful instructions pass a guardrail and reach execution logic.
• Context Engineering: The practice of selecting, curating, and delivering the information an AI system uses at runtime. In agentic environments, context engineering is a security function because the quality, provenance, and trust level of the inputs directly shape the system’s actions and outputs.
• Agentic Context Inheritance: The reuse of prior prompts, documents, tool outputs, or memory objects as live input to later model decisions. For autonomous or semi-autonomous systems, this creates a governance problem because untrusted context can persist long enough to alter downstream tool use.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an IAM programme, it is worth exploring.