A Single Prompt Template Broke Most of the Models It Was Tested On
A researcher found that a synthetic transcript generation prompt worked as a universal jailbreak, succeeding 84-100% of the time against nine of 23 models tested.
A researcher working through the MATS programme found that a prompt originally designed to generate synthetic transcripts could be turned into a universal jailbreak template, achieving attack success rates of 84 to 100% against nine of 23 models tested.
Only recent Anthropic models and Meta's Muse Spark 1.1 were never fully broken.
What makes this finding notable
Jailbreaks are not new, and most are narrow — a specific phrasing that works against a specific model until it is patched. Three features distinguish this one:
- It is universal, functioning as a template rather than a single prompt.
- Success rates of 84-100% mean it works nearly every time rather than occasionally.
- It was derived from a legitimate technique — synthetic transcript generation is a standard method for producing training data.
That third point is the interesting one. The attack was not constructed adversarially from scratch. It emerged from repurposing a tool built for an entirely benign use.
Why that pattern recurs
Safety training teaches models to decline certain requests. But a request framed as "generate a transcript in which a character does X" is structurally different from "do X" — it invokes the model's capacity to produce fiction, examples and training data, all of which are legitimate functions that cannot simply be disabled.
The difficulty is that the boundary between simulating harmful content and producing it is not clean. It depends on context, intent and use, none of which a model observes directly.
The differential result
Fourteen of 23 models were not fully broken, and the report specifically identifies recent Anthropic models and Meta's Muse Spark 1.1 as never fully broken. That variation is useful: it establishes the vulnerability is not inherent to the architecture, and that some training approaches resist it better than others.
How disclosure of this kind works
Published research into model vulnerabilities is genuinely dual-use. Publication informs the people who can fix the problem and the people who might exploit it.
The prevailing convention borrows from security research: disclose to developers first, allow time for mitigation, then publish. That balance is contested, and the argument is not settled.
The context it lands in
More than 373 model releases have been tracked across major organisations. At that pace, a technique that generalises across architectures has an unusually large surface to work against — and patching one model does nothing for the rest.