Interactive tracker
Still Works? Tracker: Q2 2026 Archive
Archived Q2 2026 snapshot of LLM jailbreak technique classes by model family. Directional only; each cell names the class-level source it leans on.
Assessed Q2 2026 — last updated 2026-05-12.
Model safety changes weekly. Treat every cell as a directional summary of published reporting for the quarter above, not a live guarantee. Re-verify against the linked source before relying on it.
| Technique class | Claude (Opus/Sonnet 4.x) | GPT-4.x / o-series | Gemini 2.x | Llama 3.x / 4 (instruct) | Mistral / Mixtral | Qwen 2.5 / 3 |
|---|---|---|---|---|---|---|
| Persona redefinition DAN/AIM-style alter-ego prompts that instruct the model to drop its policy and adopt an unrestricted character. Single-turn prompt | Patched Q2 2026Directional only. Wei et al. establish the class; they do not evaluate this model. | Patched Q2 2026Directional only. Wei et al. establish the class; this cell is not a measured result for this model. | Hardened Q2 2026Directional only. Wei et al. establish the class; they do not evaluate this model. | Partial Q2 2026Directional only. The abliteration write-up shows refusal behaviour can be edited out of open weights; it does not test persona prompts. | Active Q2 2026Directional only. Wei et al. establish the class; they do not evaluate this model. | Partial Q2 2026Directional only. Wei et al. establish the class; they do not evaluate this model. |
| Encoding / obfuscation smuggling Base64, ciphers, ASCII art, leetspeak and Unicode-tag tricks that hide intent from input filters while the model still decodes it. Single-turn prompt | Hardened Q2 2026Directional only. ArtPrompt establishes the class; it does not evaluate this model. | Hardened Q2 2026Directional only. CipherChat establishes the class; this cell is not a measured result for this model. | Partial Q2 2026Directional only. ArtPrompt establishes the class; it does not evaluate this model. | Partial Q2 2026Directional only. CipherChat establishes the class; it does not evaluate this model. | Active Q2 2026Directional only. CodeChameleon establishes the class; this cell is not a measured result for this model. | Partial Q2 2026Directional only. CipherChat establishes the class; it does not evaluate this model. |
| Multimodal injection Instructions hidden in images (typographic / faint text) or adversarial perturbations that vision-language models read and act on. Multimodal input | Hardened Q2 2026Directional only. FigStep measures typographic jailbreaks on six open-source vision-language models and does not evaluate this model, so no published per-version result supports or contradicts this cell. | Partial Q2 2026Directional only. Bagdasaryan et al. establish the class on open-source multimodal models; they do not evaluate this model. | Partial Q2 2026Directional only. FigStep establishes the class on open-source vision-language models; it does not evaluate this model. | Active Q2 2026Directional only. Qi et al. establish the class on open-source vision-language models; they do not evaluate this model. | Active Q2 2026Directional only. Bagdasaryan et al. establish the class on open-source multimodal models; they do not evaluate this model. | Active Q2 2026Directional only. FigStep establishes the class on open-source vision-language models; it does not evaluate this model. |
| Crescendo / multi-turn escalation Benign opening that escalates over several turns, each referencing the model's own prior answers, until it crosses the line. Multi-turn conversation | Partial Q2 2026Directional only. Crescendo establishes the class; it does not evaluate this model. | Partial Q2 2026Directional only. Crescendo establishes the class; this cell is not a measured result for this model. | Active Q2 2026Directional only. ActorAttack establishes the class; this cell is not a measured result for this model. | Active Q2 2026Directional only. Crescendo establishes the class; this cell is not a measured result for this model. | Active Q2 2026Directional only. Crescendo establishes the class; this cell is not a measured result for this model. | Active Q2 2026Directional only. ActorAttack establishes the class; this cell is not a measured result for this model. |
| Many-shot in-context Long context filled with faux compliant dialogue turns so in-context learning generalizes compliance to the real query. Multi-turn conversation | Hardened Q2 2026Directional only. Anthropic's many-shot write-up establishes the class; it does not evaluate this model. | Hardened Q2 2026Directional only. Anthropic's many-shot write-up establishes the class; this cell is not a measured result for this model. | Partial Q2 2026Directional only. Anthropic's many-shot write-up establishes the class; it does not evaluate this model. | Active Q2 2026Directional only. The in-context attack paper establishes the class; this cell is not a measured result for this model. | Active Q2 2026Directional only. The in-context attack paper establishes the class; this cell is not a measured result for this model. | Active Q2 2026Directional only. Anthropic's many-shot write-up establishes the class; it does not evaluate this model. |
| GCG / adversarial suffix Gradient-optimized gibberish suffixes (and fluent AutoDAN successors) appended to a request to force an affirmative response. Automated / gradient optimization | Hardened Q2 2026Directional only. Zou et al. establish the class; they do not evaluate this model. | Hardened Q2 2026Directional only. AutoDAN establishes the class; this cell is not a measured result for this model. | Partial Q2 2026Directional only. Zou et al. establish the class; they do not evaluate this model. | Active Q2 2026Directional only. Zou et al. establish the class; they do not evaluate this model. | Active Q2 2026Directional only. AutoDAN establishes the class; this cell is not a measured result for this model. | Active Q2 2026Directional only. Zou et al. establish the class; they do not evaluate this model. |
| System-prompt extraction Coaxing the model to reveal its hidden system prompt to expose guardrail logic for follow-on attacks. Single-turn prompt | Hardened Q2 2026Directional only. Zhang et al. establish the class; they do not evaluate this model. | Partial Q2 2026Directional only. Zhang et al. establish the class; this cell is not a measured result for this model. | Partial Q2 2026Directional only. Zhang et al. establish the class; this cell is not a measured result for this model. | Active Q2 2026Directional only. Zhang et al. establish the class; this cell is not a measured result for this model. | Active Q2 2026Directional only. Zhang et al. establish the class; this cell is not a measured result for this model. | Active Q2 2026Directional only. Zhang et al. establish the class; this cell is not a measured result for this model. |
| Indirect prompt injection (agentic) Adversarial instructions planted in web pages, documents or tool results that an LLM agent ingests and obeys as if from the user. Agentic / retrieval context | Partial Q2 2026Directional only. Greshake et al. establish the class; they do not evaluate this model. | Active Q2 2026Directional only. The OWASP LLM Top 10 documents the class; it does not evaluate any model. | Active Q2 2026Directional only. Greshake et al. establish the class; they do not evaluate this model. | Active Q2 2026Directional only. The OWASP LLM Top 10 documents the class; it does not evaluate any model. | Active Q2 2026Directional only. Greshake et al. establish the class; they do not evaluate this model. | Active Q2 2026Directional only. Greshake et al. establish the class; they do not evaluate this model. |
No rows match these filters.
Status legend
- Active
- — works with low effort against a default deployment
- Partial
- — works inconsistently or only with extra effort / scaffolding
- Hardened
- — usually refused; only edge cases or stacked techniques get through
- Patched
- — reliably refused on the model versions this column covers
Click any technique name to open our postmortem. Click a status pill to expand the per-model note and source.