Video subtitles can double as a jailbreak lever for AI vision models - not because of what they say, but when they say it.
A team of researchers built TempJail, a black-box attack framework that targets large vision-language models (LVLMs) through the subtitles baked into video. Instead of just embedding harmful text on screen, TempJail arranges dialogue-style subtitle sequences and tunes their timing - how long each line stays up and where it falls in the video - to slip past a model's safety training. The researchers found that jailbreak success depends as much on this temporal scheduling as on the words themselves. Tested against four LVLMs across two datasets, TempJail beat the strongest existing baseline by 53 percentage points in average attack success rate on GPT-5 and by 18 points on Gemini 3.5-Flash.
That gap matters because most prior video jailbreak research treated timing as an afterthought, focusing on what text appears rather than how it's paced. TempJail treats pacing as the exploit itself, and subtitles make an easy delivery vehicle since they're standard in real video and don't look visually suspicious. As video-capable assistants spread into more products, that's a gap in safety testing most teams probably haven't thought to close.
Text and image jailbreaks took years of patching to get even partially under control. Video models are barely shipping, and the cracks are already showing.