Editorial desk
Jailbreaks FYI Editorial
Jailbreaks FYI Editorial is the publishing identity for Jailbreaks FYI. It is a desk, not a person: no named author, no biography, no professional certifications.
Articles published under this byline are researched from primary sources — vendor and project documentation, published standards and specifications, research papers, and measurements published by whoever took them — drafted with AI assistance, and edited against those cited sources before publication. Nothing here is based on first-hand testing in a private lab, and any figure that appears is attributed to the source it came from.
Corrections go to hello@jailbreaks.fyi. More detail is on the about page and the editorial disclosure.
Posts (23)
- Defense
How to Detect LLM Jailbreak Attempts: A 5-Layer Stack
Detect LLM jailbreaks in five layers: normalized signatures, perplexity scoring, input classifiers, output classifiers and per-session telemetry.
- Tooling
Open Source LLM Security Tools: Licensing and Cost
Open source LLM security testing tools compared on license and self-hosting cost: garak, PyRIT, promptfoo, and Meta's Purple Llama safeguards.
- Tooling
JailbreakBench Dataset Explained: JBB-Behaviors vs AdvBench
JailbreakBench uses 100 JBB-Behaviors, a versioned artifacts repo and a fixed judge. Compare it with AdvBench, HarmBench, StrongREJECT and JailbreakV-28K.
- Techniques
Payload Splitting: How Fragmented Prompts Evade LLM Filters
Payload splitting hides a forbidden request in harmless fragments an LLM reassembles past the filter. See an example, its variants and which defenses work.
- Tooling
LLM Red Teaming Tools Compared: Garak, PyRIT & More
Compare Garak, PyRIT, Promptfoo and Giskard by license, interface, multi-turn support, CI fit, deployment scope and documented LLM security coverage.
- Defense
Lethal Trifecta and CaMeL: Containing Agent Injection
The lethal trifecta explains why agents get exfiltrated, and CaMeL shows what containment by construction looks like. Both are architecture, not prompting.
- Defense
Best LLM Guardrail Tools 2026: A Practitioner's Comparison
A technical comparison of the best LLM guardrail tools 2026: NeMo Guardrails, LLM Guard, Lakera, Guardrails AI, and Azure Content Safety, with benchmarks.
- Foundations
How LLM Jailbreaks Work: Techniques and Success Rates
A practitioner's breakdown of how LLM jailbreaks work, from roleplay conditioning to multi-turn manipulation, with attack success rates from research.
- Techniques
DAN, Evil Confidant & Skeleton Key Jailbreaks Explained
Evil Confidant is a persona jailbreak that casts the model as an evil trusted confidant. Learn how it, DAN and Skeleton Key work and how to stop them.
- Defense
LLM Defense Stack: Guardrails, Tool Scoping, and Egress
An LLM defense stack maps jailbreaks and prompt injection to guardrail models, scoped tools, least privilege, egress controls, and human approval.
- Foundations
Why LLM Jailbreaks Work: 2 Safety Training Failures
LLM jailbreaks exploit competing objectives and gaps between model capability and safety training. Learn the two failure modes and what defenders can do.
- Techniques
ArtPrompt Post-Mortem: Why ASCII-Art Bypasses Worked
A walkthrough of the ArtPrompt ASCII-art jailbreak: where it slipped past safety training, how model families patched it, and which encodings still land.
- Tooling
Garak in 2026: what it's actually good for, what it isn't
An honest review of NVIDIA's Garak LLM vulnerability scanner: what its probes catch, where the noise is, and where it fits in a real testing pipeline.
- Attack Surfaces
LLM Agent Hijacking: Tool Abuse from Injected Content
Tool-using LLM agents get hijacked by the content they read. The exploit classes that have hit production agents, and the patterns that contain them.
- Red Team Practice
Model Behavior Fingerprinting: Identifying a Wrapped LLM
Before attacking an LLM app you need to know which model is under the hood. A walkthrough of behavioral fingerprinting and what each signal reveals.
- Techniques
Multi-Turn Role-Play Attacks: Why One Safe Turn Gets Unsafe
Crescendo, many-shot and gradual context manipulation: how multi-turn jailbreaks evade single-turn classifiers, and what still lands against defenses.
- Techniques
Multimodal Jailbreaks: Image and Audio Attack Surfaces
Vision and audio inputs are a separate attack channel from text. A survey of the multimodal jailbreaks that still land, from typographic to audio carriers.
- Tooling
PAIR vs GCG vs TAP: Automated Jailbreak Frameworks
A practitioner comparison of the automated jailbreak frameworks PAIR, GCG, and TAP: threat model fit, compute cost, transferability, and when to run each.
- Attack Surfaces
Prompt Injection in IDE Coding Agents: Copilot and Cursor
Coding assistants read everything in your repo and increasingly act on it. A walkthrough of the prompt-injection variants that have shipped against them.
- Attack Surfaces
Hardening RAG Pipelines Against Prompt Injection
Retrieval pulls attacker-controlled text into the model's prompt. A defender's guide to where RAG injections land in production and how to contain them.
- Red Team Practice
Scoping an AI Red-Team Engagement: The Questions That Matter
A working methodology for scoping LLM red-team engagements: the threat-model conversation, surface inventory, success criteria, and the scoping traps.
- Techniques
System Prompt Extraction: Techniques and Defenses
How system prompts get exfiltrated from production LLM apps: direct extraction, indirect inference, behavioral fingerprinting, and what actually works.
- Techniques
10 LLM Jailbreak Technique Classes and Defenses
A source-based taxonomy of ten LLM jailbreak classes, how each attack surface works, and the defensive controls and benchmarks used to evaluate it.