What is an LLM jailbreak? Jailbreaking AI models, defined

A jailbreak is an attack that makes a large language model (LLM) produce output its developer set it up to refuse, usually by crafting prompts that slip past its safety training, guardrails or system instructions. NIST classes it as a direct prompting attack aimed at circumventing restrictions on model outputs, and MITRE ATLAS tracks it as technique AML.T0054, LLM Jailbreak.

How the owners of the term define it

The definitions agree on the goal and differ on the boundary. In NIST AI 100-2 E2025, a jailbreak is a direct prompting attack whose purpose is misuse, and NIST adds that in every variant the aim is to defeat a model-level safety defense. NIST also notes that an indirect prompt injection can carry a jailbreak, letting an attacker swap their own instructions for the model's system prompt.

OWASP's LLM01:2025 entry treats jailbreaking as a form of prompt injection that leads the model to disregard its safety protocols entirely. NIST's Generative AI Profile, AI 600-1, published on 26 July 2024, describes it more simply as manipulating prompts to get around output controls.

MITRE's ATLAS entry is the broadest. It counts prompt strategies such as roleplay, multi-turn escalation and encoding, and also direct changes to model weights that produce a jailbroken or uncensored variant of an open model.

Why it matters to a CISO

For a chat assistant, a jailbreak mostly produces content the company would not want to publish. Inside an agent, it becomes an access problem: ATLAS lists jailbreaks under both Defense Evasion and Privilege Escalation, since a jailbroken model can be pushed to invoke tools for the attacker. ATLAS rates the technique "Realized", meaning it has been observed in real incidents, not only in research.

The practical lesson is that refusal behaviour is a control that wears out. ATLAS notes that working jailbreak prompts are often published openly and that model providers keep updating guardrails as new prompts appear. A security team should therefore assume a determined user can get past model-level safety, and put the hard limits on permissions and actions outside the model.

Where it appears on cisonews.ai

The site's record of Microsoft naming the Storm-2139 developers covers a case of bypassing Azure OpenAI safeguards. The prompt injection explainer sets jailbreaking beside the wider injection problem, and the ATLAS technique index groups logged incidents by technique.

Related terms

Prompt injection, AI guardrails, AI red teaming and MITRE ATLAS.