AI models are jailbreaking each other with a 97% success rate

The jailbreak threat used to be a guy with too much free time and a Reddit thread. Now it’s one AI quietly talking another AI into producing harmful content — automatically, at scale, with a 97% success rate.

A peer-reviewed paper just published in Nature Communications — “Large reasoning models are autonomous jailbreak agents” by Hagendorff, Derner, and Oliver — deployed four reasoning models (DeepSeek-R1, Gemini 2.5 Flash, Grok 3 Mini, and Qwen3 235B) as autonomous adversaries against nine widely-used target models. No human in the loop after the initial system prompt. Overall jailbreak success rate: 97.14%.

The gap between defenders is brutal. Claude 4 Sonnet was the standout — it refused harmful content in over half of all attempts and reached maximum harm in only 2.86% of cases. DeepSeek-V3 was the other extreme: a 90% maximum harm rate and a refusal rate of just 4.18%.

The scarier finding isn’t the number — it’s what the authors call alignment regression: as reasoning models get more capable, they also get better at dismantling alignment in other systems. Better AI → better jailbreaker. It’s a feedback loop baked into the capability curve itself.

The practical upshot is that this is no longer expensive or technically specialized. One capable reasoning model, a system prompt, and the target is basically open. The authors note it’s now accessible to non-experts.

Claude holding the line better than everyone else will be useful for exactly one news cycle before people start asking why the rest of the ecosystem is so porous. The answer, per this paper, is structural — and getting worse as models improve.