Jailbreaks Have Moved From the Chat Window to the Config File

There is a genre of GitHub repository that tells you something about the state of AI without intending to. Alejandros17487/ai-jailbreaks is a curated collection of 35 jailbreak prompts targeting more than 25 models, and on its face it is exactly what the name promises: files you paste into a system prompt, an AGENTS.md, an Ollama Modelfile, or a harness config slot to make a model behave in ways its vendor would prefer it didn’t. The README wraps this in a research-and-education disclaimer. It also wraps it in banner ads for an API reseller that promises “Uncensored and Abliterated models that never refuse.” Both things are true at once, and the tension between them is the most interesting thing about the project.

What’s actually in the box

Strip away the framing and the collection is a taxonomy of instruction surfaces. The files are organized not by technique but by where the prompt goes: conversational system prompts for Claude and Gemini variants, workspace operating profiles for coding agents, AGENTS.md drop-ins that agent harnesses automatically pick up from a repository root, Ollama Modelfiles that bake a persona directly into a local model, and one Grok file explicitly designed for a harness’s config field rather than the conversation.

That last category is the tell, and it’s the genuinely notable part. The classic jailbreak — DAN, roleplay framing, “pretend you are an AI with no restrictions” — lived in the chat window. It was a social-engineering attack against a conversational interface. What this repo documents, whether intentionally or not, is the migration of jailbreaking from conversation to infrastructure. When a model reads its operating instructions from a file in your repo, or a Modelfile on your machine, or a config block in your harness, the jailbreak stops being something you say to the model and becomes something you install alongside it. The persona lock, the “operating floor,” the workspace policy — these are attempts to occupy the instruction hierarchy from below, replacing the vendor’s policy layer with a local one that the model treats as authoritative.

The collection’s breadth is also its own kind of data. It spans closed frontier models (Claude, Gemini, Grok, Mistral), open-weight families (GLM, DeepSeek, Kimi, Qwen, Gemma, GPT-OSS), and a cluster of what the README calls “free stealth models” on a service called OpenCode Zen — names like Big Pickle, Space Bunny, and Muse Spark that read like they were generated by a slot machine. I can’t verify these model versions against any of the sources here, and the README itself concedes the point in its own note: prompt behavior is version-dependent, system prompts rotate, and what works on one release may fail on the next. The repo is a snapshot of a moving target, maintained the way a moving target has to be maintained — through issues and pull requests.

The business model is the disclaimer’s problem

It would be pleasant to report that this is a clean research artifact. It isn’t. The README’s centerpiece is a 600-pixel-wide animated ad for 7API, billed as “the cheapest API for frontier models at up to 99% off,” with the explicit pitch that if your jailbreak isn’t working, you can just buy access to uncensored models instead. There are Telegram channel buttons. There’s a Telegram bot. The ad appears above the collection, below the collection, and in the warning that precedes it.

This creates an awkward arrangement. The disclaimer says the repo exists to document how persona framing and instruction hierarchies shape model behavior — “the same findings that help developers harden AI against prompt injection.” The ad says that if the documented findings fail, there’s a commercial product that skips the hardening part entirely. A corpus of jailbreak prompts is a legitimate research object; the academic literature on red teaming depends on exactly this kind of material. A jailbreak corpus that funnels frustrated users toward a reseller of refusal-free models is a lead-generation asset with a research disclaimer stapled to it. The repo is both, and readers should weigh it accordingly.

There’s also a ToS question the README acknowledges but doesn’t resolve: providers may restrict these prompts under their terms of service, and the disclaimer puts the burden of knowing that on the user. That’s honest, in the way a waiver is honest.

The cat-and-mouse economy it sits inside

Whether or not this particular collection matters, the phenomenon it indexes demonstrably does. Jailbreak attempts succeed roughly 20% of the time, according to IBM Research cited by Ironscales, with attackers needing about 42 seconds and as few as five interactions to bypass guardrails — some in under four seconds. Cybercrime forums saw jailbreak mentions surge 50% through 2024, with malicious AI tools like WormGPT and FraudGPT up more than 200% from the year before. This is not a hobbyist curiosity; it’s an active supply chain.

The technique lineage the repo draws from is well documented. DAN — “Do Anything Now” — emerged in late 2022 and spread through Reddit before providers hardened against it, but its roleplay DNA persists in every persona-based variant since. Microsoft’s security team described Crescendo, a multi-turn technique that gradually desensitizes a model across a conversation, exploiting the fact that safety mechanisms tend to evaluate individual prompts rather than full conversational context — and noted that many variations are discovered, tested, and mitigated on a rolling basis. The repo’s own versioning convention — a significant revision gets a new file, not a silent overwrite, hence opus-v1 and opus-v2 sitting side by side — is a small-scale mirror of that arms race. Each versioned file is a tombstone for a patch cycle somewhere.

What’s newer, and what the repo’s config-file orientation reflects, is the agentic expansion. OWASP’s agentic red-teaming work frames prompt injection, jailbreaks, tool poisoning, and memory manipulation not as edge cases but as intrinsic properties of AI systems — and agentic systems widen the attack surface because agents execute actions, call APIs, and chain decisions across trust boundaries. A jailbreak that lives in an AGENTS.md file isn’t tricking a chatbot into saying something naughty; it’s potentially re-tasking an agent that has tools, permissions, and access to your data. The boring part — where the file goes — is exactly where the risk is.

As research, it’s missing the parts that make research

Here the repo deserves a straight assessment. The defensive side of this field has converged on a standard of evidence this collection doesn’t attempt. Cinder, a commercial red-teaming firm, publishes outcomes with numbers: a reported 90%-plus reduction in CSAM/NCII vulnerability in Black Forest Labs’ FLUX.2 across iterative testing cycles, sub-1% NSFW metrics for Krea checkpoints evaluated in eight days before release. Pillar Security’s RedGraph engine claims multi-turn attack chains, permission-flow analysis, and findings validated with complete attack transcripts and reproduction steps. The difference between those artifacts and this repo is the difference between an experiment and a claim.

The repo’s contribution guidelines ask for honesty — “don’t advertise compatibility you haven’t tested” — but there’s no testing methodology, no transcripts, no success criteria, no harm taxonomy, no indication of what any of these prompts actually produced. A file is documented as a “VANTA persona lock with explicit operating floor” and that’s the entire evidentiary record. That’s not a knock on a hobbyist collection; it’s a knock on the research framing. CSET’s analysis of AI red-teaming argues the whole discipline suffers from weak theoretical grounding and wildly varying practice — that tool and threat-model choices can produce a false sense of security in either direction. A paste-ready corpus with no threat model at all sits at the shallow end of that problem.

A recent paper from CMU’s Software Engineering Institute makes a related structural point: cyber red teams and AI red teams operate as mostly separate communities, with cyber teams reporting better coverage of engagement stages and AI teams lacking pre-engagement, scanning, and vulnerability-analysis phases. A GitHub repo of jailbreak prompts, monetized through an API reseller, is what the AI side of that gap looks like at the grassroots — adversarial material with none of the surrounding discipline, from rules of engagement to coordinated disclosure, that the cyber world spent decades building.

The part worth watching

Two things about the project are genuinely well-designed, and they’re both boring, which is usually the sign of something real. The first is the versioning convention: one prompt per file, model-named, hyphenated, with significant revisions getting new files rather than silent overwrites. That turns the repo into a diffable history of what worked when — a fossil record of the arms race, if the maintainers keep it up. The second is the surface-specificity: every file declares where it goes, because the same text means different things in a system prompt versus an AGENTS.md versus a Modelfile. That’s an implicit acknowledgment that the instruction hierarchy — which instruction wins when system prompt, workspace policy, and user message disagree — is the actual attack surface, not the words themselves.

The open questions are the obvious ones. Will the collection stay current as models and harnesses rotate, or will it rot into a gallery of expired prompts, as its own warning half-predicts? Will the 7API advertising grow or shrink relative to the research framing? And does a corpus like this, by making jailbreaks frictionless, meaningfully change the threat picture — or does it just redistribute the same techniques that circulate on Telegram and cybercrime forums anyway, now with a contribution guide? The Ironscales data suggests the techniques were never scarce. What a repo adds is indexing, and indexing is how a pile of files becomes a reference.

The honest summary: this is a well-organized, honestly-disclaimed, ad-monetized collection of jailbreak prompts whose real value is accidental. It documents, in its file structure alone, that jailbreaking has followed the models out of the chat window and into the configuration layer where agents now live. The defensive industry already treats that layer as the front line. Whether the repo’s maintainers see themselves as part of that conversation or just as its inventory is a question the ads answer more clearly than the disclaimer does.