02 — attack concepts

Jailbreak

Defeating a model's safety training so it produces output it would normally refuse. The distinction from prompt injection is about whose intent is being subverted: a jailbreak subverts the model provider's policy, while an injection subverts the user's or application's intent. In practice the same string often does both, and the two words are frequently used interchangeably — but a control that stops jailbreaks does not automatically stop injections, and vice versa.

Related terms

  • Prompt injection Attack concepts

    Getting a language model to follow instructions it was not supposed to follow, by placing those instructions somewhere the model treats as input.

  • Model refusal Testing & measurement

    The underlying model declining the request on its own, with no security product involved.

  • DAN Attack families

    The original hand-written persona jailbreak: the model is told to role-play an unrestricted alter ego that "has broken free" of its rules, often with an…

Attack concepts

The mechanisms the families above exploit, plus the agent-specific ones that have no chatbot equivalent. If you only read one entry on this page, read indirect prompt injection.

Jailbreak is term 4 of 14 in this part of the glossary.

Get started free Full glossary → How we test → Community agent on GitHub ↗

This page is one entry from the agentic AI security glossary, which defines 60 terms in the same style. Where a term belongs to a published taxonomy or standard — the HackAgent attack families, the OWASP lists, AMTSO's guidelines, MITRE ATLAS, ISO/IEC 42001, the NIST AI RMF, the EU AI Act — the authoritative wording is the source document's, not ours, and specifics should be verified there. "Lethal trifecta" is Simon Willison's term. OWASP® is a trademark of the OWASP Foundation; ATT&CK® and ATLAS™ are trademarks of The MITRE Corporation. Naming a framework here is description, not a claim of certification or endorsement.

glick.run — AGPL-3.0