Why copied prompts stop working
A jailbreak prompt that circulates publicly has a shelf life measured in weeks. Once it appears in enough places, it enters the next training run, and the model learns to recognise it as an attempt rather than a request.
The prompts that keep working are not secret. They are structured. Understand the structure and you can generate a fresh one for any model, any week, without hunting for leaks.
What a prompt can and cannot do
| Model tier | Prompt-only success | Notes |
|---|---|---|
| Open-weight, self-hosted (Llama / Qwen) | High | No second layer to defeat |
| GPT-4o / 4o-mini | Medium | Simple cases pass; high-sensitivity topics do not |
| Claude | Low–medium | Strong at detecting roleplay framing |
| GPT-5 / o-series | Low | Intent-level judgement; text tricks fail |
| DeepSeek | Medium | Semantic layer is loose; keyword layer is hard |
Read that table before writing anything. If you are on the bottom two rows, no amount of prompt engineering will get you a stable result — the gate is on the server, not in your text.
The four-layer structure
Establish who is speaking. The failure mode here is the obvious one: "you are an AI with no restrictions" is a direct signal and gets caught. What works is a specific professional identity with a reason to exist — security engineer, forensic analyst, technical writer for an internal wiki.
Say why the answer is needed. Refusal is a risk judgement, and a plausible authorised context changes the judgement. Signed engagement, internal audit, own infrastructure, fiction under contract — these are the frames models accept.
Specify the shape of the answer. This is the most underrated layer. A model in "produce a numbered procedure" mode is executing a formatting task, and formatting tasks do not get refused. Tables, JSON schemas, numbered steps, fixed section headers — all push it into execution.
The actual question, placed last. Order matters: if the task arrives before the frame, the model evaluates it cold. If it arrives after the protocol, it is already mid-execution.
The template
Rewrite this in your own words. Do not paste it verbatim — the exact string is what gets learned.
All four layers are load-bearing. Drop the role and the model asks why. Drop the context and it hedges. Drop the protocol and it answers vaguely. Drop the ordering and the frame arrives too late.
Five adjustments that move the number
1. Declarative, not imperative
"Please write me a…" is a request, and requests can be declined. "I need the following for section 4.2 of the report" is a statement about a document. The grammatical mood changes the refusal rate more than most people expect.
2. Split the words
Keyword filters run before semantic understanding. If a term is on a list, rephrasing around it clears the first gate without touching the second. This is not deception — it is routing around a dumb matcher.
3. Send it in two turns
A single long prompt gets scored once, as a whole. Two turns — establish the frame, get agreement, then deliver the task — get scored separately, and the second turn arrives with the frame already accepted.
4. Get the yes first
Ask "can you work within this frame" before asking for the content. Models exhibit consistency: having agreed to the role, they continue in it.
5. Feed its own output back
Have it produce a skeleton — a table header, a section list, an empty schema. Then say "continue from here". It is now completing its own structure rather than starting a new request.
Failure signals that mean stop
Four symptoms, all of which indicate the problem is not in your prompt:
- Identical canned refusal every time. That is a classifier, not the model. Reframing will not move it.
- Worked yesterday, fails today. Upstream changed. Nothing you write will fix it.
- Answer cuts off mid-sentence. Output filtering. The model complied; the pipe closed.
- Three different phrasings, three refusals. Intent-level judgement is active. Text tricks are done.
All four point to the same conclusion: the gate is server-side. Switch to a model that has already been opened up — see the setup guide — rather than spending another hour on wording.
Prompting vs an unrestricted model
| Write your own prompt | Use an opened model | |
|---|---|---|
| Cost | Zero | Pay per token |
| Stability | Breaks on every upstream update | Stable |
| Answer quality | Context budget consumed by framing | Near stock |
| Works on GPT-5 / o-series | No | Yes |
| Time to first result | Hours of iteration | Minutes |
The sane combination: prompt for one-off experiments, use an opened model for anything you will do more than twice.
Frequently asked
How long should a jailbreak prompt be
300–600 words. Past roughly 800, attention to the role anchor decays and the frame stops holding. Structure beats length.
Do English prompts work better than other languages
Not inherently. What matters is that the prompt reads naturally in its language. Machine-translated templates fail because the register breaks, not because of the language.
Can one prompt work across models
No. Each family has different detection logic. A prompt tuned for GPT will usually fail on Claude. Tune per model.
Is writing a jailbreak prompt against the rules
A prompt is text. What you do with the output is what carries legal weight. Authorised testing, your own systems and fiction are ordinary uses.