Topics
Browse everything Jailbreaks FYI publishes by category and tag: every topic covered here, with the most recent guides listed under each one.
Tags
- #llm-security 16
- #red-team 15
- #jailbreaks 11
- #prompt-injection 9
- #guardrails 4
- #tooling 3
- #agents 2
- #encoding-attacks 2
- #advbench 1
- #agent-hijacking 1
- #agent-security 1
- #ai-safety 1
- #ai-security 1
- #alignment 1
- #alignment-bypass 1
- #artprompt 1
- #ascii-art 1
- #attack-classes 1
- #attack-techniques 1
- #audio-attacks 1
- #automated-jailbreaks 1
- #cipher 1
- #competing-objectives 1
- #consulting 1
- #content-filtering 1
- #copilot 1
- #crescendo 1
- #cursor 1
- #dan 1
- #defense 1
- #defense-in-depth 1
- #drattack 1
- #engagement-design 1
- #evaluation 1
- #evil-confidant 1
- #fingerprinting 1
- #frameworks 1
- #garak 1
- #gcg 1
- #generalization 1
- #harmbench 1
- #ide-agents 1
- #jailbreak-benchmarks 1
- #jailbreak-detection 1
- #jailbreakbench 1
- #many-shot 1
- #methodology 1
- #model-identification 1
- #monitoring 1
- #multi-turn 1
- #multimodal 1
- #obfuscation 1
- #open-source 1
- #owasp-llm-top-10 1
- #pair 1
- #payload-splitting 1
- #persona-injection 1
- #post-mortem 1
- #prompt-extraction 1
- #rag 1
- #rag-security 1
- #reconnaissance 1
- #safety-training 1
- #scoping 1
- #skeleton-key 1
- #strongreject 1
- #supply-chain 1
- #system-prompt-leak 1
- #tap 1
- #taxonomy 1
- #tool-use 1
- #vision-attacks 1
Categories
Techniques 7 posts
- Payload Splitting: How Fragmented Prompts Evade LLM FiltersPayload splitting hides a forbidden request in harmless fragments an LLM reassembles past the filter. See an example, its variants and which defenses work.
- DAN, Evil Confidant & Skeleton Key Jailbreaks ExplainedEvil Confidant is a persona jailbreak that casts the model as an evil trusted confidant. Learn how it, DAN and Skeleton Key work and how to stop them.
- ArtPrompt Post-Mortem: Why ASCII-Art Bypasses WorkedA walkthrough of the ArtPrompt ASCII-art jailbreak: where it slipped past safety training, how model families patched it, and which encodings still land.
- Multi-Turn Role-Play Attacks: Why One Safe Turn Gets UnsafeCrescendo, many-shot and gradual context manipulation: how multi-turn jailbreaks evade single-turn classifiers, and what still lands against defenses.
- Multimodal Jailbreaks: Image and Audio Attack SurfacesVision and audio inputs are a separate attack channel from text. A survey of the multimodal jailbreaks that still land, from typographic to audio carriers.
- System Prompt Extraction: Techniques and DefensesHow system prompts get exfiltrated from production LLM apps: direct extraction, indirect inference, behavioral fingerprinting, and what actually works.
Tooling 5 posts
- Open Source LLM Security Tools: Licensing and CostOpen source LLM security testing tools compared on license and self-hosting cost: garak, PyRIT, promptfoo, and Meta's Purple Llama safeguards.
- JailbreakBench Dataset Explained: JBB-Behaviors vs AdvBenchJailbreakBench uses 100 JBB-Behaviors, a versioned artifacts repo and a fixed judge. Compare it with AdvBench, HarmBench, StrongREJECT and JailbreakV-28K.
- LLM Red Teaming Tools Compared: Garak, PyRIT & MoreCompare Garak, PyRIT, Promptfoo and Giskard by license, interface, multi-turn support, CI fit, deployment scope and documented LLM security coverage.
- Garak in 2026: what it's actually good for, what it isn'tAn honest review of NVIDIA's Garak LLM vulnerability scanner: what its probes catch, where the noise is, and where it fits in a real testing pipeline.
- PAIR vs GCG vs TAP: Automated Jailbreak FrameworksA practitioner comparison of the automated jailbreak frameworks PAIR, GCG, and TAP: threat model fit, compute cost, transferability, and when to run each.
Defense 4 posts
- How to Detect LLM Jailbreak Attempts: A 5-Layer StackDetect LLM jailbreaks in five layers: normalized signatures, perplexity scoring, input classifiers, output classifiers and per-session telemetry.
- Lethal Trifecta and CaMeL: Containing Agent InjectionThe lethal trifecta explains why agents get exfiltrated, and CaMeL shows what containment by construction looks like. Both are architecture, not prompting.
- Best LLM Guardrail Tools 2026: A Practitioner's ComparisonA technical comparison of the best LLM guardrail tools 2026: NeMo Guardrails, LLM Guard, Lakera, Guardrails AI, and Azure Content Safety, with benchmarks.
- LLM Defense Stack: Guardrails, Tool Scoping, and EgressAn LLM defense stack maps jailbreaks and prompt injection to guardrail models, scoped tools, least privilege, egress controls, and human approval.
Attack Surfaces 3 posts
- LLM Agent Hijacking: Tool Abuse from Injected ContentTool-using LLM agents get hijacked by the content they read. The exploit classes that have hit production agents, and the patterns that contain them.
- Prompt Injection in IDE Coding Agents: Copilot and CursorCoding assistants read everything in your repo and increasingly act on it. A walkthrough of the prompt-injection variants that have shipped against them.
- Hardening RAG Pipelines Against Prompt InjectionRetrieval pulls attacker-controlled text into the model's prompt. A defender's guide to where RAG injections land in production and how to contain them.
Foundations 2 posts
- How LLM Jailbreaks Work: Techniques and Success RatesA practitioner's breakdown of how LLM jailbreaks work, from roleplay conditioning to multi-turn manipulation, with attack success rates from research.
- Why LLM Jailbreaks Work: 2 Safety Training FailuresLLM jailbreaks exploit competing objectives and gaps between model capability and safety training. Learn the two failure modes and what defenders can do.
Red Team Practice 2 posts
- Model Behavior Fingerprinting: Identifying a Wrapped LLMBefore attacking an LLM app you need to know which model is under the hood. A walkthrough of behavioral fingerprinting and what each signal reveals.
- Scoping an AI Red-Team Engagement: The Questions That MatterA working methodology for scoping LLM red-team engagements: the threat-model conversation, surface inventory, success criteria, and the scoping traps.