Claim and evidence Close ×
GPT-5 System Card states evaluation result ↓ The card reports that the UK AISI safeguards team identified multiple model-level jailbreaks overcoming gpt-5-thinking's built-in refusal logic, one of which it says evades all layers of mitigations and is being patched. The GPT-5 System Card states that the UK AI Security Institute's safeguards team identified multiple model-level jailbreaks that overcome gpt-5-thinking's built-in refusal logic without degrading model capabilities, and that one of them evades all layers of mitigations and is being patched. Copy claim link
Copy claim reference
Machine-checked, not reviewed by an editor Stated in source Supported
Supporting evidence: primary · 1 source
Subject version As dated August 13, 2025 on its cover · Published 2025-08-13 · Effective date not established Date 2025-08-13 · publication Evaluated system gpt-5-thinking with its deployed safeguards, as of the card What the report measured Robustness of the model's refusal behaviour and of the surrounding safeguard layers in the biological and chemical domain By what kind of method Safeguards stress testing by an external government institute with access to prototype safeguard components The result, in the report’s words Multiple model-level jailbreaks identified that overcome the built-in refusal logic without degradation of capabilities; the card states the resulting content is flagged by its generation monitor, and that one jailbreak evades all layers and is being patched The caveats the report gives The card adds that, in practice, creating such a jailbreak would have produced numerous flags leading to account enforcement; that claim is the developer's and is not recorded as a finding. Scope and limits The developer's report of an external team's finding, at the date of the card. It is not the institute's own published report, says nothing about what any jailbreak could produce, and is not evidence about the state of the safeguards at any later date. No technique, prompt or output is recorded; only the existence of the finding as the card states it.
The evidence 02 primary source Supports the claim
GPT-5 System Card ↗ OpenAI · Publication date unknown
Copy source reference
Cite the original source Cite the original document, not Selekoa. Check these details against it.
Copy APA
Download BibTeX Download RIS Download CSL-JSON
Source excerpt “The UK AISI's Safeguards team identified multiple model-level jailbreaks that overcome gpt-5-thinking's built-in refusal logic without degradation of model capabilities” Location in source PDF p. 53 (printed p. 52), §5.3.3.5 External government red teaming
How it was read Retrieved directly from the publisher
Machine-checked · 2026-10-30
Source details and check notes Authors OpenAI Version Retrieved for the candidate pack on 2026-10-28 (SHA-256 f9f9c72d08cba81dcbb189129119357c8c32eca4e0b16c813aca386aed6b0459). PDF dated August 13, 2025 on its cover, as served on 2026-10-28. Retrieved again at admission on 2026-10-30 (SHA-256 f9f9c72d08cba81dcbb189129119357c8c32eca4e0b16c813aca386aed6b0459, the same bytes). Canonical address Open the canonical source ↗ Accessed 2026-10-28 Language English (en) Attribution OpenAI, “GPT-5 System Card”. Reuse No open redistribution licence asserted. Bibliographic metadata, editorial paraphrases and short attributed quotations (at most 50 words each). Recheck terms before wider redistribution. Check notes Candidate pack passage, AI and biosecurity (research/ai-bio). The quotation (20 words) matched the text retrieved for the candidate pack on 2026-10-28 and again at admission on 2026-10-30, in a fresh retrieval whose SHA-256 equals the pack’s. Matching ignored differences of whitespace, case, quotation marks, dashes and Unicode compatibility forms, so the source’s typography can differ. A cross-family machine check (2026-10-30, item 38) re-read the record’s sources and found full support. No human editorial review. primary source Supports the claim
GPT-5 System Card ↗ OpenAI · Publication date unknown
Copy source reference
Cite the original source Cite the original document, not Selekoa. Check these details against it.
Copy APA
Download BibTeX Download RIS Download CSL-JSON
Source excerpt “One of the jailbreaks evades all layers of mitigations and is being patched.” Location in source PDF p. 53 (printed p. 52), §5.3.3.5 External government red teaming, sentence following the jailbreak finding
How it was read Retrieved directly from the publisher
Machine-checked · 2026-10-30
Source details and check notes Authors OpenAI Version Retrieved for the candidate pack on 2026-10-28 (SHA-256 f9f9c72d08cba81dcbb189129119357c8c32eca4e0b16c813aca386aed6b0459). PDF dated August 13, 2025 on its cover, as served on 2026-10-28. Retrieved again at admission on 2026-10-30 (SHA-256 f9f9c72d08cba81dcbb189129119357c8c32eca4e0b16c813aca386aed6b0459, the same bytes). Canonical address Open the canonical source ↗ Accessed 2026-10-28 Language English (en) Attribution OpenAI, “GPT-5 System Card”. Reuse No open redistribution licence asserted. Bibliographic metadata, editorial paraphrases and short attributed quotations (at most 50 words each). Recheck terms before wider redistribution. Check notes Candidate pack passage, AI and biosecurity (research/ai-bio). The quotation (13 words) matched the text retrieved for the candidate pack on 2026-10-28 and again at admission on 2026-10-30, in a fresh retrieval whose SHA-256 equals the pack’s. Matching ignored differences of whitespace, case, quotation marks, dashes and Unicode compatibility forms, so the source’s typography can differ. Added after the audit of 2026-10-28: the statement's second half rested on no cited passage. 'Is being patched' is the card's own present tense at its date of publication; the record asserts nothing about any later state. A cross-family machine check (2026-10-30, item 38) re-read the record’s sources and found full support. No human editorial review. Status and meaning Editorial status. Not reviewed by an editor . An exploratory record that no editor has accepted. This status does not say whether a person has read any linked passage. Each evidence record above shows how it was checked.
Relation. A report states the result of an evaluation it ran or commissioned, in its own words, with what was measured, by what kind of method, and the caveats the report itself gives (schema 2.22). The record is the report’s statement, not a verified finding: it says nothing about another system, a later version or real-world risk, and a null or limiting result is not evidence that no effect exists.
Date. As reported in the card of 13 August 2025; the state described is that of publication.
Record ID ab-ev-gpt5-uk-aisi-jailbreak-finding