AI labs can ship stronger safeguards, but the public record now says universal jailbreaks still keep appearing across frontier systems. If you build on these APIs, you shouldn't treat the model's guardrails as your whole security plan.
If your product depends on API access to a frontier model, the Pliny the Liberator story is worth taking seriously. Just don't build it on an unverified blast from X. The claim that he announced a July 24 universal jailbreak for every top model tested, including GPT-5.6 Sol Ultra, Opus 5, and Fable, couldn't be confirmed in live search, and it shouldn't be printed as fact.
The verified record is uncomfortable enough.
According to SANS Institute, which announced Pliny as a keynote speaker for its April 20 and 21 AI Cybersecurity Summit in Arlington, Pliny is a pseudonymous hacker known for breaking major AI models soon after release and posting techniques to a GitHub repository with more than 10,000 stars. SANS also said he leads BT6, a 28-operator white-hat collective, and that TIME included him in its 2025 TIME100 AI list. Those are specific claims from a named institution, not rumor dressed up as reporting.
So yes, he matters. But the bigger story isn't one researcher's latest teaser. It is the fact that AI safety flaws still don't have a clean disclosure system, even as models are being wired into products that handle customer support, coding, payments workflows, medical paperwork, legal intake, and internal company data. Any startup treating refusal behavior as a security boundary is taking on more risk than it probably admits to customers.
The verified record is bad enough
The UK's AI Security Institute has said in its Frontier AI Trends Report that it has found universal jailbreaks for every system it has tested. That sentence should stop you. AISI defines these as attacks that work across a range of malicious requests for a model and says they can reliably extract policy-violating information close to the level of a similarly capable model without safeguards.
That isn't a fringe concern.
AISI says it partners with top AI companies to stress-test safeguards and that model providers have made progress, especially in biological misuse defenses. OpenAI, for example, said when it launched GPT-5.6 on July 9 that the model family uses layered protections, real-time checks, monitoring, and access calibrated to trust and risk. The company also said GPT-5.6 is stronger in cybersecurity and biology than earlier models - and stays below its Critical threshold in both categories.
You can believe both things at once. The labs are putting more engineering into safety, and attackers are still finding ways around it. That is the whole tension.
OpenAI's GPT-5.6 launch page also shows why this problem is moving fast. The company describes Sol as its flagship model, with Terra and Luna below it, and says ultra coordinates multiple agents across parallel workstreams. More agentic capability means more useful work for customers. It also means jailbreaks, prompt injection, tool misuse, and weak app-level permissions become harder to reason about once a model can plan, call tools, and keep working across steps.
Here's the thing: your system prompt is not a security program.
It can help. Moderation can help. Provider-side controls can help. But if your application lets an AI agent read sensitive data, send email, update records, or execute code, you need permissions, logging, human review for high-risk actions, and clear failure paths outside the model itself. Otherwise you're asking a language model to enforce the boundary that protects the business.
Disclosure still has no home
Traditional software security has rough norms. A researcher notifies a vendor, the vendor gets time to patch, and the vulnerability eventually becomes public. It isn't perfect, but people at least know the dance. AI jailbreak disclosure is messier because there may be no clean version number, no single patch, and no obvious way to prove a model is fixed rather than temporarily less responsive to one prompt family.
The White House fact sheet for President Donald Trump's June 2 executive order shows the political machinery starting to move. It calls for an AI cybersecurity clearinghouse, classified benchmarking for advanced AI cyber capabilities, and a voluntary framework for secure early access to covered frontier models. That is relevant. It still doesn't give independent jailbreak researchers a simple cross-lab place to disclose a technique that affects OpenAI, Anthropic, Google, xAI, you name it.
That gap leaves too much to personality and timing. A well-known researcher can decide to disclose quietly, post publicly, wait for a conference, or hold details while talking to select red-teamers. A less careful researcher can do something worse. The infrastructure shouldn't depend on which kind of person finds the flaw first.
For companies building on top of these models, the immediate move is practical. Inventory what your AI features can actually do. Separate low-risk text generation from actions that touch customer data, money, credentials, production systems, or regulated workflows. If a jailbreak would turn a chatbot into a bad answer machine, that's one problem. If it would turn an agent into an employee with access and no supervision, that's another.
Pliny's reputation is real. The July 24 universal-jailbreak claim in the published draft wasn't verified. The safer, stronger article is the one supported by SANS, AISI, OpenAI, and the White House record: frontier AI safeguards are improving, universal jailbreaks are still being found, and disclosure norms are lagging behind the products already shipping.
That's enough to act on.
Also read: A New Brunswick lawmaker read his AI chatbot's rewriting instructions aloud in the legislature and didn't notice • Bluesky turns Attie into a social research tool and the open protocol is the whole point • xAI is shipping Grok 4.6 and 4.7 back to back in a release cadence no frontier lab has matched
