Researchers found a way to jailbreak top AI models using nothing but a made-up cipher, no fine-tuning required.
The study shows frontier models can learn simple substitution ciphers on the fly, through prompting and in-context examples, rather than needing the model retrained on encrypted data as earlier cipher attacks required. Once a model and attacker share a cipher, the model's safety training weakens or breaks down entirely when communication happens in that code. The researchers demonstrated working jailbreaks against models from Anthropic, Google, and OpenAI. Because the harmful content stays encrypted, it looks like gibberish to the automated classifiers meant to catch it.
That's the real find here: this is a filter-evasion problem, not just an alignment one. Harmfulness classifiers built to scan plain-language outputs have nothing to flag when the payload is ciphertext, meaning the defense layer sitting in front of a model can be blind exactly when it matters most.
Earlier cipher jailbreaks needed access to a fine-tuning API to teach the model the code. This one just needs a prompt, which makes it available to anyone with a chat window and cuts out a step defenders were relying on to limit exposure.