Notifications
Clear all
Topic starter
01/08/2026 10:45 pm
TL;DR: Jailbreak success rates of 78.5% for multi-turn attacks and 61.0% for single-turn attacks were found in a red team of GPT-5.2 by Promptfoo, with harmful outputs including illegal-drug instructions, harassment, disinformation, and child-grooming content despite strong refusal behavior on direct prompts. Structured jailbreak testing remains necessary even when model safety looks strong in casual use.
NHIMG editorial — based on content published by Promptfoo: GPT-5.2 jailbreak testing and red team findings
By the numbers:
- The headline numbers: our jailbreak strategies improved attack success from 4.3% baseline to 78.5% (multi-turn) and 61.0% (single-turn).
- Results covered 4,229 probes across 43 risk categories in about 30 minutes.
Questions worth separating out
Q: How should security teams test LLMs for jailbreak risk before production?
A: Test the model with both single-turn and multi-turn adversarial prompts, plus indirect injection from the same content channels your application will ingest.
Q: Why do LLMs still produce unsafe outputs after passing basic safety tests?
A: Basic tests usually measure ordinary user behavior, not structured adversarial prompting.
Q: What do security teams get wrong about reasoning-enabled models?
A: They often treat reasoning as a safety guarantee instead of a risk reducer.
Practitioner guidance
- Run adversarial red team tests before release Test both single-turn and multi-turn jailbreaks against the exact model, prompt templates, and tool integrations you plan to deploy.
- Gate tool execution behind explicit confirmation Require human approval or policy checks before any model output can trigger destructive actions, external requests, or privileged workflows.
- Validate outputs against policy before downstream use Add post-generation checks for harmful content categories, unsafe instructions, and prompt-injection artifacts before content reaches users or automation.
What's in the full report
Promptfoo's full post covers the operational detail this post intentionally leaves for the source:
- The exact red team config used to run 43 harmful-content, bias, and security-compliance plugins against GPT-5.2.
- The category-by-category outputs, including the examples the authors chose not to publish in full.
- The low-reasoning re-test and the change in success rates across Hydra, Meta, and baseline attacks.
- The recommended quick-start workflow for reproducing the eval in your own environment.
👉 Read Promptfoo’s red team analysis of GPT-5.2 jailbreak resilience →
GPT-5.2 jailbreak resilience: what security teams need to know?
Explore further
01/08/2026 10:54 pm
LLM jailbreak resilience is now an AI governance problem, not just a model safety problem. The article shows that refusal behavior can look strong under ordinary prompting while structured adversarial input still succeeds at scale. That means the control boundary is no longer the model alone, but the full system around it, including prompts, connectors, tool execution, and review workflows. Practitioners should evaluate controls under attack conditions, not normal usage assumptions.
A question worth separating out:
Q: How should organisations prevent model outputs from triggering harmful actions?
A: Separate generation from execution. Any output that could launch a tool, send a message, change a record, or delete data should pass through confirmation, policy checks, and logging before it is acted on. That makes the model advisory until the surrounding system explicitly authorises the action.
👉 Read our full editorial: GPT-5.2 jailbreak testing shows safety gaps under pressure
