AI red teamer Pliny the Liberator revealed on X on July 25, 2026 JST that he had found a jailbreak method effective against "all models," including GPT-5.6 Sol, Claude Opus 5, and Claude Fable 5. He stated that it worked across every category he tried, and that a complete fix might be extremely difficult. At the same time, he is withholding the method for the time being, citing responsible disclosure. No attack prompts or success rates have been confirmed, and neither the number of attempts, the target tasks, nor the actual outputs have been shown. What needs to be verified differs depending on whether "universal" means working across many prohibited tasks within a single model, or extends to mean the same method can be transferred across multiple companies' defenses.
"Universal" Requires Two Separate Proofs
OpenAI defines a universal jailbreak as a method that succeeds across many prohibited requests without needing to redesign the attack for each individual request. This measures "cross-task" generality within a single model. Pliny's post goes further, claiming the same method works across multiple models from both OpenAI and Anthropic, which adds "cross-model" generality to the mix.
The two are not the same thing. A prompt that works across multiple tasks on GPT-5.6 Sol won't necessarily transfer directly to Claude. Conversely, even if you can elicit a prohibited response from multiple models one time each, that doesn't prove cross-task universality unless the same method can sustain a chain from vulnerability discovery through exploit code creation. The phrase "every category I tried" in the post also doesn't mean it covers each company's entire policy, since no category names were given.
Verification requires a testing table broader than a screenshot listing model names. It needs to use the same set of prohibited tasks and show the number of attempts per model. Criteria for judging success versus failure are also essential. Success rates on the first attempt versus with retries included need to be separated, and whether the output actually works needs to be confirmed as well. Furthermore, APIs, chat interfaces, and code execution environments have different system instructions and external classifiers even under the same model name. Which delivery environment was tested, under what settings, is also part of the result.
The Battle Over GPT-5.6 That Didn't End Even After 700,000 GPU-Hours
For GPT-5.6 Sol, this isn't the first time the existence of a universal jailbreak has been raised. Before releasing the model, OpenAI conducted automated red teaming exceeding 700,000 A100-equivalent GPU-hours using optimization search, reinforcement learning, and inference-time search. The best attack discovered achieved a 10.0% success rate in internal testing before additional countermeasures, dropping to 0% against the same attack after countermeasures were applied.
Mixing in a separate figure of 83.0% here would distort the meaning. OpenAI reported that, under conditions with defensive blocking removed, a jailbroken model solved 83.0% of CyberGym tasks, versus 83.6% for GPT-5.6 Sol without any attack applied. This comparison is meant to show whether the model's cyber capability was largely preserved even with a jailbreak applied. It is not a figure representing breaking through 83.0% of production defenses.
Results from the UK AI Security Institute (UK AISI) convey a different difficulty facing defenders. UK AISI tested under special conditions with visibility into the safety classifier's reasoning, the exact policy text, and classification labels, and found a universal cyber-domain jailbreak in every round of iterative testing with OpenAI. Some attacks could carry out long procedures spanning vulnerability discovery through exploit development, with some examples taking only a few hours to develop. OpenAI reproduced and patched the individually reported attacks, but UK AISI expects new attacks to be found through similar testing going forward.
In other words, closing off a specific attack and eliminating an entire family of attack techniques are different jobs. OpenAI's 0% result demonstrates the former. If Pliny's claim of "can't be fully fixed" means the latter, it would need to demonstrate that success rates hold up even after variations of the attack, and that it recurs against models with countermeasures applied.
For Opus 5, Start by Confirming Which Model Actually Responded
Claude Opus 5 was released on the same date as Pliny's post in UTC terms—July 24, 2026. Anthropic's defenses are not configured identically for Fable 5. Opus 5 permits requests to find vulnerabilities from source code, while a classifier blocks vulnerability searches in compiled binaries, penetration testing, and exploit generation. Anthropic estimates that Opus 5's classifier intervenes roughly 85% less often than Fable 5's.
Product-side fallback behavior also complicates verification. In Claude.ai, Claude Code, and Claude Cowork, when the cyber classifier detects a request directed at Opus 5, the system defaults to switching to Opus 4.8. Even if a user has selected Opus 5 on screen, there's no guarantee that the model returning a prohibited response was actually Opus 5. Reproduction reports need to identify which model ultimately responded.
In the Opus 5 system card, Anthropic states it found no evidence of a jailbreak rated "Critical" for either Opus 5 or Fable 5. In internal testing, automated attackers were given up to 400 calls per task, in an environment that automatically judged whether goals were achieved—such as ransomware, data exfiltration, or exploitation of real-world vulnerabilities. Anthropic described the attack success rate as "very low" but did not provide a specific numerical figure in the text.
External testing also provides comparison material. Trajectory Labs spent about 100 hours and completed one task using task-specific prompting but found no new universal method. 10a Labs failed to achieve the target task in roughly 16 hours of testing, and Gray Swan's automated attacks also failed with 150 attempts per task. If Pliny's method surpasses these, it would need to be reproduced on tasks with at least comparably clear completion criteria.
What Withholding Disclosure Lowers Is "Discoverability"
Along with the re-release of Fable 5, Anthropic presented a provisional scale for evaluating cyber-domain jailbreaks, ranging from CJS-0 to CJS-4. What this evaluates is not the mere fact that a refusal was broken, but what new capability is handed to an attacker.
| Evaluation Axis | What It Checks | What Remains Unknown This Time |
|---|---|---|
| Uplift | How much it accelerates experts or non-experts beyond existing tools | Whether outputs reproduce known information or represent genuinely new usable results |
| Breadth | How many types of attack tasks the same method works against | The breakdown of "all categories" and any failure cases |
| Ease of weaponization | How much manual tuning, retries, or dedicated harnesses are needed | Whether it works in one shot or requires skilled prompting |
| Discoverability | Whether the method is already public or could be rediscovered without specialized work | Who has received it, and how widely it has been shared |
What the table reveals is that the decision to withhold disclosure primarily lowers "discoverability." Uplift and breadth can be high or low regardless of whether the method is kept secret. In Anthropic's framework, a method that provides high uplift and works across all categories could still receive a lower rating than a publicly known one-shot attack, if it remains undisclosed and hard to handle. Conversely, if it becomes reproducible by anyone after disclosure, the risk would spike.
Prior research supports the possibility of weaknesses shared across multiple models. "Endless Jailbreaks with Bijection Learning," presented at ICLR 2025, demonstrated a method that teaches a model an arbitrary reversible encoding scheme within a conversation, then encodes prohibited requests and responses to bypass safety mechanisms. The research team confirmed its effectiveness across multiple frontier models and harm categories, and reported that models with stronger reasoning capabilities can sometimes be more vulnerable to the attack. However, this result neither proves that Pliny's undisclosed method operates on the same mechanism, nor that it can defeat 2026 production defenses.
The Next Fork in the Road: Reproduction Logs and Working Tasks
Pliny states he wants to share the method with AI red-teaming, safety research, and policy experts before any public disclosure. Value as responsible disclosure materializes when each company receives the attack, reproduces it under identical conditions, and determines the scope of impact. There's no need to make the method public. There are ways for a third party to preserve a non-public test set and publish success rates and attempt budgets broken down by model and category. Execution results and post-countermeasure retesting can also be reported without revealing the attack procedure itself.
For companies operating their own AI products, this post alone is not, at this stage, a reason to halt model usage. That said, designs that rely solely on a model's refusal as the sole safety mechanism should be avoided. Both GPT-5.6 and Claude combine model training with input/output classifiers, layered with permission controls and monitoring. In your own systems, you need to restrict the credentials and execution privileges given to AI, and require dangerous operations to be approved through a separate control layer.
What will settle the evaluation is not the publication of a sensational example response, but reproducible proof that the same method completes long, working tasks against different models, with a verifiable success rate. Once that log appears, "universal" becomes a technical finding. If it doesn't, this announcement will remain an unverified warning.