A newly described jailbreak gets multimodal AI models to generate harmful content by wrapping the request inside a story they tell themselves.
The attack, called NarrativeAttack, is detailed in an arXiv preprint (arXiv:2509.26473) that has not been peer-reviewed. It targets unified multimodal models, systems that both understand and generate images within the same conversation. The method builds a three-act narrative: the model generates a setup image, a hidden middle act carries the actual malicious request disguised as the story's climax, and the model generates a resolution image. A final step hides the harmful question among benign options in an image-based guessing game, pushing the model to pick and answer it based on the narrative context it just built for itself.
According to the preprint's authors, the technique reached an 88.25% attack success rate against Google's Gemini-2.5-Flash, topping the prior jailbreak methods tested in the same paper. That gap matters because most AI safety testing still treats text prompts and image prompts as separate problems, rather than as a chain of context a model accumulates and trusts across a multi-turn conversation.
Until vendors start testing for that kind of layered, self-referential prompting instead of just one-shot text or image attacks, a well-told story may be all it takes to talk a model into something it was built to refuse.