BehaviorsEstablished
Jailbreak
noun / verb
An attempt to use prompts to make an AI model bypass restrictions on what it is supposed to say or do.
Talking your way past the guardrails
Phones were jailbroken before chatbots were.
With generative AI, the word took on a new meaning.
Instead of modifying software on the device, someone tries to use language to push the model beyond its intended restrictions.
NIST's AI glossary defines a jailbreak as a direct prompting attack intended to circumvent restrictions placed on model outputs.
Someone found another jailbreak that gets the model to answer things it normally refuses.
Original example written for this dictionary.
The metaphor fits neatly.
There is an invisible boundary around the model's behavior.
The jailbreak is the attempt to get outside it.
DAN made jailbreaking internet culture
One of the most famous early examples was DAN, short for Do Anything Now.
DAN-style prompts told ChatGPT to role-play an unrestricted alter ego that supposedly did not have to follow its usual rules.
By early 2023, variations of DAN and other jailbreaks were spreading through online communities. WIRED described jailbreak creators continually developing new prompt strategies as older ones were blocked, with DAN becoming the most prominent example.
DAN mattered culturally because it gave jailbreaks a character.
Instead of talking about instruction hierarchies, alignment or safety training, the story became extremely easy to understand:
ChatGPT has rules. DAN is the version that supposedly doesn't.
That framing helped turn a technical failure mode into an internet pastime.
For a while, it felt like a game
Early chatbot jailbreaking often had the rhythm of a puzzle.
A model refused something.
A user changed the framing.
Someone posted a screenshot of a prompt that appeared to work.
Other people copied it.
Then the model changed, the trick became unreliable, and a new variation appeared.
WIRED documented that cat-and-mouse dynamic as early as April 2023, noting that jailbreaks were often short-lived once providers adjusted their systems.
That is one reason names such as DAN can survive even after the exact prompt associated with them stops working reliably.
The prompt becomes outdated.
The cultural reference survives.
Why jailbreaks keep changing
A jailbreak is not usually a permanent switch hidden inside a model.
Providers change models, training methods, system instructions and safety layers. A technique that appears effective against one version may work inconsistently — or not at all — against another.
Researchers also continue to discover new classes of attacks.
Microsoft's 2024 Skeleton Key research, for example, described a multi-turn jailbreak technique that affected several tested generative AI models.
So saying a model was “jailbroken” does not mean it has been permanently unlocked.
It usually means safeguards failed under a particular technique, model and setup.
Is a jailbreak a prompt injection?
The terminology overlaps.
Microsoft explicitly describes jailbreaks as direct prompt injection attacks: adversarial input supplied directly by the person interacting with the model in an attempt to alter its intended behavior.
NIST uses closely related language. Its glossary defines a jailbreak as a direct prompting attack, and defines a direct prompt injection as a direct prompting attack that exploits prompt injection.
That is different from indirect prompt injection.
In an indirect attack, the malicious instruction may be embedded in external material — such as a webpage or document — that an AI system later reads.
So a useful shorthand is:
Jailbreak: usually a direct attempt to push the model past its restrictions.
Indirect prompt injection: hostile instructions reach the model through content it processes.
Different security frameworks draw the boundaries slightly differently, so the terms should not be treated as perfectly interchangeable.
From internet trick to security vocabulary
That may be the most interesting evolution of jailbreak.
In early chatbot culture, the word often described a clever prompt someone discovered online.
Today, organizations including NIST and Microsoft use jailbreak terminology inside formal AI security research and threat definitions.
The internet slang did not disappear.
It became security vocabulary too.