Attack pack timeline

This reference lists attack pack vectors added each month, with the most recent month first. The total attack pack contains more than 10,000 malicious prompts.

October 2026: Involuntary in-context learning

What it is: This one-turn attack uses examples in a prompt to weaken safety refusals. It uses abstract labels to frame harmful requests. It does not rely on role-play or many examples.

How it works:

• The prompt mixes safe and harmful examples.
• Each example uses the operators answer and is_valid.
• Safe examples have the label No. Harmful examples have the label Yes.
• The final input tells the model to use this pattern and produce an answer with the label Yes.

Why it matters: The model can follow the pattern instead of detecting the harmful request. This behavior can bypass safety filters. The source study reports a 100% bypass rate when the prompt uses five safe examples and five harmful examples with matching topics.

September 2026: Stylistic reformulation

What it is: This single-turn attack reformulates harmful requests as poetry, folktales, or other literary styles.

How it works: The attack transforms harmful vocabulary into metaphorical language. It recasts harmful prompts as poetic or literary structures, using rhyme, meter, and figurative speech. These stylistic irregularities disrupt the model's surface pattern recognition trained for safety.

Why it matters: This attack works across a large range of models and topics. LLMs process poetic prompts with distinct attention patterns, and safety refusal logic does not reliably transfer to stylistic variants. The technique is single-turn and black-box, making it difficult to detect.

August 2026: Morality dilemma

What it is: This attack method targets moral judgment. It adds unclear, reversed, or conflicting norms.

How it works: The attack introduces vague or misleading norms. It also adds competing rules, role prompts, and injected instructions to steer moral conclusions.

Why it matters: This attack shows how conflicting norms can skew moral reasoning in general LLMs and guardrail models.

July 2026: Cyberpunk stories

What it is: This is a single-turn story attack called Adversarial Tales. It embeds restricted step-by-step content in fiction and then asks for structured story analysis.

How it works: The attacker hides sensitive procedures in a short story. The prompt then asks the model to extract and reconstruct them during story analysis.

Why it matters: Story framing plus structured analysis can bypass refusal checks. The attack does not require obfuscation or multi-turn interaction.

June 2026: Bias framing

What it is: This black-box jailbreak exploits demographic bias in model alignment.

How it works: The attacker adds demographic keywords to prompt templates. They then compare refusal and compliance behavior to find higher-risk framing.

Why it matters: Bias is not only a fairness issue. It can also become an attack surface for jailbreak optimization at scale.

May 2026: Topic steering

What it is: This indirect prompt-injection method targets LLM apps that use external content, such as search results. It moves from benign content to attack instructions.

How it works: The attack creates a multi-turn bridge dialogue. The dialogue narrows the topic gap until the attack looks relevant, often with a final reminder prompt.

Why it matters: Gradual transitions can be more effective than abrupt injections. This can also work against some advanced prompt-injection defenses.

April 2026: Developer-role attack

What it is: This jailbreak family abuses the developer role in API-style chat setups. It suppresses refusals and forces compliance.

How it works: The attacker builds simulated developer contexts with always-comply framing. An extended variant adds fake reasoning cues so the context seems credible.

Why it matters: This targets real API chat setups that use system and developer messages. It shows that role simulation can overpower guardrails.

March 2026: Sugar-coated poison

What it is: This two-stage jailbreak starts with a benign rewrite. It then uses output patterns to increase unsafe continuation.

How it works: Stage 1 transforms a restricted prompt into a safe version with the opposite intent. Stage 2 appends an attack module that starts with safe content, then shifts toward disallowed content.

Why it matters: The model tends to stay on task and continue patterns. Attackers can exploit this in long, structured outputs, including code and JSON.

February 2026: Invasive context engineering

What it is: This long-context attack treats the context window as the target in multi-turn conversations.

How it works: The attacker repeatedly injects control sentences, such as rules, reminders, and instructions. These controls can persist as earlier alignment directives weaken over long conversations.

Why it matters: Attackers can maintain behavior drift or attack control in long interactions. They can do this without model access or weight changes.

January 2026: Persona bullying

What it is: This multi-turn approach exploits persona setup and social pressure. It uses harmless persona traits to increase unsafe model behavior.

How it works: The attacker conditions the assistant into a specific persona. They then apply escalating pressure across multiple turns to weaken refusals.

Why it matters: This highlights a gap in persona-driven, multi-round applications. Safety controls must adapt to changing context.

December 2025: Adversarial Metaphor

What it is: This black-box, multi-turn technique disguises restricted requests as benign metaphor and analogy tasks. The goal is to reduce refusals.

How it works: The attack maps sensitive entities and actions to a benign metaphor domain. It then uses guided follow-up prompts and repeated tuning to steer the model toward disallowed content.

Why it matters: This can evade keyword and toxicity checks. It also works across multiple model families.