A new red-teaming framework called EvoFlint shows that even Claude Sonnet 4.6 still folds to a patient enough conversation.
EvoFlint treats multi-turn jailbreaking as a search problem rather than a generation problem. Instead of grinding out one-off prompts, it evolves phased conversation plans through LLM-driven mutation and crossover, scoring each on a mix of attack success rate and peak severity so near-misses still shape the next generation. A risk-indexed archive runs novelty search to keep the strategy pool diverse without locking into a fixed style taxonomy, and a shared memory feeds insights about each target model back into new attempts. Tested on the HarmBench-test benchmark, EvoFlint reached a 35.8% attack success rate against Claude Sonnet 4.6, 59.7% against GPT-5.4, 94.3% against Qwen3-32B, and 98.7% against the older GPT-4o.
That spread is the real finding. Most automated red-teaming produces a pile of prompts that get patched and forgotten; EvoFlint instead produces a persistent, per-category map of which harms a model's safety training actually covers, which is more useful to defenders than a single pass/fail score. The gap between a 35.8% break rate on a frontier model and a 94.3% break rate on an open-weight one also says something about where safety tuning budgets are, and aren't, being spent.
Worth remembering that today's hardest target is tomorrow's baseline: the paper's own GPT-4o numbers show a model that looked safe on release now failing nearly every attack.