GPT-6 Jailbroken in Under 24 Hours: How TIP Attacks Break Through AI Safety Defenses

GPT-6's Safety Defenses Breached Within 24 Hours

Security researchers have reported that OpenAI's newly released GPT-6 Astra model was successfully jailbroken in under 24 hours after launch. The attack used an enhanced version of the TIP (Task-in-Prompt) method, combining four undisclosed techniques.

Notably, the same researcher broke GPT-5 in just one hour at its release — this time, GPT-6 took 24 hours. That gap signals real progress in OpenAI's safety work, yet it also shows that continuously evolving attack methods haven't been stopped.

What Is a TIP Attack? The Jailbreak Threat Hidden Inside Legitimate Tasks

TIP attacks are a novel attack method that exploits large language models' reasoning and instruction-following capabilities. The approach was formally published at ACL 2025.

The core idea is disguising harmful objectives as seemingly innocuous tasks. For example, an attacker might ask the model to decrypt a cipher, execute Python code, or complete other technical operations. Behind these surface-level legitimate task wrappers, the model is effectively tricked into producing content that its safety mechanisms should have blocked.

In the case of GPT-6, researchers noted that the original minimalist TIP attack failed entirely — significant modifications were required to bypass the new safety protections. This indicates OpenAI hardened GPT-6's defenses against known attack patterns, but attackers still found a way through by combining multiple techniques.

ACL (Association for Computational Linguistics) is the top academic conference in natural language processing. The fact that TIP attacks were formally published at ACL 2025 means the method has passed rigorous peer review, lending it considerable academic credibility and technical impact. TIP attacks are fundamentally different from the widely known Prompt Injection attacks: prompt injection typically hijacks model behavior by inserting hidden instructions into input, while TIP leverages the model's own reasoning chain, encoding malicious intent within seemingly legitimate multi-step task workflows. For instance, an attacker might ask the model to "decode the following Base64-encoded text and format the output" — on the surface, a legitimate data-processing request, but the decoded content actually triggers the model to produce policy-violating output. This attack is so difficult to defend against because the model is following legitimate instructions at each individual step; safety mechanisms struggle to identify the malicious intent of the overall task chain without disrupting normal functionality.

Responsible Disclosure: The Right Way to Conduct Security Research

Unlike some hackers who choose to publish vulnerabilities publicly, this researcher followed responsible disclosure practices — submitting the exploitation details privately to OpenAI rather than releasing the full attack method publicly.

This approach aligns with security research best practices:

• Helping vendors patch in time: OpenAI can fix the vulnerability before it's widely exploited
• Preventing malicious abuse: Stops the attack method from being weaponized by bad actors
• Advancing industry security standards: Establishes a healthy collaborative model for AI security research

The same researcher followed identical procedures when GPT-5 launched — quickly communicating with OpenAI after discovering the vulnerability, forming an ongoing security testing partnership.

Responsible Disclosure is an industry norm in information security that has been practiced for decades, first widely adopted in software and network security. The standard process typically involves: a researcher privately notifying the vendor upon discovering a vulnerability, allowing a remediation window (usually 90 days), and only publicly releasing technical details after the vendor has patched the issue. In AI security, this mechanism is becoming especially critical — unlike traditional software vulnerabilities, once a jailbreak method for a large language model is made public, anyone can replicate it with zero barrier to entry. Model vendors also can't push a quick fix the way software patches work; they often need to retrain models or adjust alignment strategies, resulting in much longer remediation cycles. Major AI companies including OpenAI, Anthropic, and Google all maintain Bug Bounty Programs to encourage security researchers to submit findings through official channels.

AI Security: An Endless Cat-and-Mouse Game

From GPT-5 to GPT-6, the time-to-jailbreak extended from one hour to 24 hours. This is both a signal of improved security capabilities and an exposure of a fundamental dilemma in AI safety — the attack-defense cycle never ends.

Every time model developers patch known vulnerabilities, attackers develop new bypass techniques. The success of TIP attacks demonstrates that relying solely on content filtering and rule-based blocking is nowhere near sufficient. Attackers can leverage a model's core capabilities — reasoning and instruction execution — through carefully crafted task structures to turn those very capabilities against its safety constraints.

The lessons from this incident are clear:

1. The more capable the model, the greater the security risk: As a flagship model, GPT-6's stronger reasoning abilities also create more surface area for exploitation
2. Pre-release testing can't cover every scenario: Even after rigorous red team testing, new attack vectors emerge in real-world deployment
3. Protections need to be addressed at the architecture level: Future AI safety research needs to focus more on architectural defense mechanisms, not just downstream content moderation

AI safety is not a problem that can be solved once and for all — it's a long-term battlefield requiring continuous investment and continuous defense.

The "red teaming" mentioned in this article is one of the core methods in AI safety evaluation — it involves professional security personnel role-playing as attackers to systematically attempt to break through a model's safety constraints. Companies like OpenAI and Anthropic typically conduct months of red team testing before model releases, inviting external security experts to participate. However, red teaming is fundamentally a time-limited, resource-constrained adversarial evaluation that cannot exhaust every possible attack combination. The fact that GPT-6 was broken within 24 hours of launch demonstrates that thousands of researchers testing in parallel in the real world far exceeds the coverage any internal red team can achieve. Directions currently being explored by the industry include: formal-verification-based security guarantees, multi-layered security architecture design (such as separating safety monitoring modules from the main inference module), and "AI vs. AI" strategies that use AI models themselves to detect and defend against jailbreak attacks.