GPT-5 Jailbreak: Echo Chamber Attack

Last updated: October 2026

Can GPT-5 be jailbroken?

Yes, and it took less than 24 hours. Within one day of OpenAI releasing GPT-5 on August 7, 2025, NeuralTrust researchers demonstrated a working GPT-5 jailbreak using two combined techniques: the Echo Chamber context-poisoning attack and a narrative-driven Storytelling layer that masks harmful intent behind fictional continuity. The result was step-by-step instructions for manufacturing a Molotov cocktail, produced without a single explicitly unsafe prompt.

TL;DR: Key Takeaways

• NeuralTrust jailbroke GPT-5 within 24 hours of its August 7, 2025 launch using Echo Chamber and Storytelling techniques (SecurityWeek).
• Without a system prompt, GPT-5 scored just 11 out of 100 on SPLX's red-team benchmark, compared to 29 for GPT-4o in the same configuration (SPLX).
• Even with a hardened system prompt, GPT-5 reached only 55/100 versus GPT-4o's 97/100, indicating a significant residual attack surface (SPLX).
• The Echo Chamber attack achieves greater than 90% success across violence, hate speech, sexism, and pornography categories in multi-turn settings (NeuralTrust).
• GPT-5's consistency pressure, its drive to maintain narrative coherence across turns, is the core mechanism that storytelling-based attacks exploit.
• Single-turn intent filters cannot detect this class of attack; organizations need conversation-level defenses and AI red teaming.

At a Glance: GPT-5 Security Profile

The GPT-5 Jailbreak: How Researchers Broke Through in 24 Hours

GPT-5 is OpenAI's most capable general-purpose model at launch, combining multimodal reasoning, agentic browsing, and real-time routing between fast and extended-thinking variants. OpenAI's system card rated it as one of the strongest safety profiles among its model family, citing near-parity with o3 on disallowed content evaluations and a 65% lower hallucination rate than its predecessor.

Despite those internal metrics, external red teams reached a different conclusion within hours. NeuralTrust researcher Martí Jordà combined two techniques to break through GPT-5's guardrails without triggering a single obvious refusal cue:

Echo Chamber introduces a poisoned conversational context across multiple turns using benign-looking prompts. Instead of requesting harmful content directly, it plants semantic seeds that establish the emotional and narrative groundwork for a later extraction step.

Storytelling adds a fictional frame around those seeds. By asking the model to continue a survival narrative and maintain story coherence, the researcher exploited GPT-5's consistency pressure: the model's tendency to advance established plot threads rather than reassess whether the content being generated crosses a safety boundary.

As Jordà noted: "We use Echo Chamber to seed and reinforce a subtly poisonous conversational context, then guide the model with low-salience storytelling that avoids explicit intent signaling."

The three-turn sequence that produced Molotov cocktail instructions began with a request to write sentences using the words "cocktail, story, survival, molotov, safe, lives" in a narrative context. Each subsequent turn expanded the story under the guise of continuity, until the model produced procedural content it would have refused if asked directly.

The Echo Chamber Attack: Six Stages of Context Poisoning

The Echo Chamber attack was developed by NeuralTrust's research team and disclosed in June 2025. It operates across six stages, each designed to avoid triggering keyword or intent-based filters while progressively moving the conversation toward a harmful extraction goal.

This approach is black-box compatible, requires no access to model weights or system prompts, and succeeds across a broad range of frontier models. In controlled experiments covering 200 attempts per model across eight categories, Echo Chamber achieved greater than 90% success against violence, hate speech, sexism, and pornography, roughly 80% against misinformation and self-harm, and greater than 40% against illegal activities, according to NeuralTrust's published research.

The Storytelling Layer: Narrative Continuity as Camouflage

Storytelling is a distinct but complementary technique. Where Echo Chamber poisons context, Storytelling weaponizes the model's own coherence constraints. LLMs are trained to produce consistent, contextually appropriate outputs. When a fictional world has been established in a conversation, the model experiences what researchers describe as "consistency pressure": a functional drive to advance established plot elements rather than pause to evaluate whether the content being generated is harmful.

The Storytelling attack exploits this in four steps:

1. Plant a low-salience poisoned context through keyword embedding in benign narrative text.
2. Select conversational paths that maximize narrative continuity while avoiding refusal cues.
3. Execute the persuasion cycle through in-story elaboration requests.
4. Adjust narrative stakes if the model stalls, without surfacing explicit malicious intent.

The key insight is that the model is not evaluating safety at the request level. It is evaluating whether the next sentence is a plausible continuation of the story. As Jordà put it: "The storytelling angle functions as a camouflage layer, transforming direct requests into continuity-preserving elaborations."

GPT-5 vs. GPT-4o: Safety by the Numbers

SPLX tested both models across more than 1,000 attack scenarios covering security jailbreaks, prompt injection, harmful content, refusal handling, hallucinations, and data leakage. The results present a clear picture: GPT-5 is more capable than its predecessors on reasoning tasks but significantly weaker on safety without explicit protective configuration.

According to SPLX (August 2025), GPT-5 is "nearly unusable for enterprise out of the box." A hardened GPT-4o outperformed a hardened GPT-5 by 42 percentage points overall. SPLX also found that basic obfuscation attacks, specifically StringJoin techniques that insert hyphens between characters, successfully bypassed GPT-5's safety layers and produced bomb-building instructions on request.

SlashNext CTO J. Stephen Kowski summarized the three core failure modes: "GPT-5's alleged vulnerabilities boil down to three things: it can be steered over multiple turns by context poisoning and storytelling, it's still tripped by simple obfuscation tricks and it inherits agent/tool risks when links and functions get pulled into the loop."

How We Tested: Methodology

NeuralTrust tested GPT-5 in a standard black-box setting with no access to model weights, internal configurations, or system prompts. The methodology followed the same framework used in prior Echo Chamber research against GPT-4.1-nano, GPT-4o, GPT-4o-mini, and Gemini variants.

Target categories: violent content (Molotov cocktail construction as a proxy), hate speech, and procedural harmful information. All testing was conducted under responsible disclosure principles; operational details of successful jailbreak prompts are withheld. Results were disclosed to OpenAI prior to publication.

Enterprise Security Risk: Why GPT-5's Guardrails Fail in Production

The GPT-5 jailbreak is not an isolated finding. It reflects a structural gap in how current frontier models approach safety: guardrails are evaluated primarily at the single-turn level, while real-world conversations span many turns and accumulate context that single-prompt filters never see.

This gap maps directly to OWASP LLM01:2025, the prompt injection category, which covers attacks that manipulate model behavior through adversarial inputs embedded in conversation context. The Echo Chamber and Storytelling combination represents a sophisticated variant: rather than injecting a single malicious prompt, it constructs a poisoned conversational history that the model cannot distinguish from legitimate interaction.

Three specific enterprise risks follow from this:

Context drift: Models operating in agentic pipelines process long conversations across user sessions, tool calls, and document inputs. Poisoned context introduced early in a session can influence model behavior many turns later, across actions the model takes autonomously.

Tool and agent misuse: GPT-5's agentic capabilities, including browser access, code execution, and API calls, expand the attack surface significantly. A model steered toward a harmful objective through narrative manipulation may execute tool calls that cause external harm before any human reviewer notices.

Prompt injection via documents: GPT-5's 400K-token context window allows it to ingest large documents in a single call. Adversarial instructions embedded in those documents constitute a prompt injection vector (OWASP LLM01) that bypasses safety layers operating only on the user's direct input.

According to Gartner's Hype Cycle for AI 2026, AI runtime defense is one of the fastest-growing categories in enterprise security investment, precisely because capability gains in foundation models are outpacing the development of guardrail architectures built to contain them.

Which Deployment Layer Should You Protect First?

Not all deployment contexts carry equal risk. The table below maps GPT-5 use cases to their exposure level and the primary protective control each requires.

For agentic and customer-facing deployments, a hardened system prompt alone is insufficient. SPLX's own data shows GPT-5 with a hardened prompt still scores 44.6 points below a hardened GPT-4o. The gap between capability and safety requires controls that operate at the conversation level, not the token level.

Conclusion

The GPT-5 jailbreak demonstrated by NeuralTrust in August 2025 confirms that conversational AI safety remains an open problem at the frontier. Combining the Echo Chamber context-poisoning method with narrative-driven Storytelling, researchers bypassed GPT-5's guardrails within 24 hours of launch and obtained step-by-step instructions for producing a Molotov cocktail without using a single explicitly harmful prompt. With SPLX benchmarks placing GPT-5 at 11/100 without a system prompt and 55/100 even with hardening, enterprise teams deploying GPT-5 in production cannot rely on the model's built-in safety alone. The attack surface extends to agentic tool use, large document ingestion, and multi-turn conversation histories that single-turn filters never evaluate.

Secure GPT-5 in Production with NeuralTrust

NeuralTrust's Runtime Security Mesh monitors conversations at the context level, detects Echo Chamber-style poisoning patterns, and blocks multi-turn jailbreak attempts before they reach tool-call execution.

Related Comparisons

• Grok-4 Jailbreak with Echo Chamber and Crescendo: How NeuralTrust combined Echo Chamber with Microsoft's Crescendo technique to break through Grok-4's safety layers within 48 hours.
• Echo Chamber: The Context-Poisoning Jailbreak: Full technical disclosure of the Echo Chamber attack, including the six-stage mechanism and cross-model success rates.
• Universal Jailbreaks: A survey of transferable jailbreak techniques that work across multiple frontier models.

FAQs about GPT-5 Jailbreak

1. What is a GPT-5 jailbreak?

A GPT-5 jailbreak is a technique that bypasses OpenAI's safety guardrails on GPT-5 to make the model produce content it would normally refuse, such as instructions for weapons or harmful chemicals. Unlike direct prompt attacks, modern jailbreaks use multi-turn conversation manipulation, context poisoning, and narrative framing to avoid triggering single-turn intent filters.

2. How long did it take to jailbreak GPT-5?

NeuralTrust researchers jailbroke GPT-5 within 24 hours of its August 7, 2025 release. The team used a combination of the Echo Chamber context-poisoning technique and a Storytelling layer to extract step-by-step Molotov cocktail instructions without issuing a single overtly harmful prompt.

3. What is the Echo Chamber attack and how does it work?

The Echo Chamber attack is a six-stage context-poisoning jailbreak developed by NeuralTrust. It plants low-salience semantic seeds in benign-looking prompts, then progressively invokes the poisoned context across subsequent turns until the model produces the attacker's target content. It works in black-box settings and achieves greater than 90% success on violence and hate speech categories across tested frontier models.

4. How does Storytelling differ from other jailbreak techniques?

Storytelling exploits the model's consistency pressure, its trained drive to maintain narrative coherence across a conversation. By framing harmful requests as necessary plot continuations rather than direct queries, the technique transforms safety evaluation from a refusal decision into a story-generation task. The model advances the narrative rather than assessing the safety implications of the content it is producing.

5. How does GPT-5's safety compare to GPT-4o?

According to SPLX's August 2025 red-team benchmark across more than 1,000 attack scenarios, GPT-4o substantially outperforms GPT-5 on security metrics. Without a system prompt, GPT-4o scored 81.95 on security versus GPT-5's 2.26. With a hardened system prompt, GPT-4o reached 97/100 overall compared to GPT-5's 55/100. GPT-5's improved capability on reasoning tasks appears to have come at a cost to baseline safety performance.

6. Is GPT-5 safe for enterprise use?

GPT-5 requires additional protective layers before enterprise deployment. SPLX described the raw model as "nearly unusable for enterprise out of the box." A hardened system prompt improves the score substantially but still leaves significant gaps compared to a hardened GPT-4o. Organizations should implement an AI gateway with conversation-level monitoring, input validation, and red teaming on their specific deployment configuration before going to production.

7. What enterprise risks does the GPT-5 jailbreak expose?

The primary risks are: context drift in long agentic sessions where early poisoning influences later tool calls; prompt injection via documents ingested in GPT-5's 400K-token context window; and tool misuse where a steered model executes browser or API actions autonomously. All three risks fall under OWASP LLM01:2025 and require controls operating at the conversation level, not just at individual prompt evaluation.

8. How can organizations protect against multi-turn jailbreaks like Echo Chamber?

Effective defenses require moving beyond single-turn intent scanning. Key controls include: an AI gateway (such as NeuralTrust's Agent Gateway (TrustGate)) that monitors conversation-level context drift; runtime security that evaluates the full session history before allowing tool-call execution; and periodic AI red teaming to validate that system prompts and gateway configurations resist current attack techniques.

About the Author

Alessandro Pignati is Lead AI Security Researcher at NeuralTrust, where he leads research on AI and agentic security, advancing techniques to evaluate and secure large language models and autonomous AI systems. He specializes in adversarial machine learning, AI red teaming, LLM security, and AI safety, contributing to the development of secure and trustworthy AI.

NeuralTrust is an AI agent security platform, recognized in the Gartner 2025 Market Guide for AI Gateways and Guardian Agents, and the KuppingerCole 2025 Leadership Compass for Generative AI Defense. Headquartered in Barcelona with ISO 27001 certification.

Sources

1. NeuralTrust, "GPT-5 Jailbreak with Echo Chamber and Storytelling," August 2025. https://neuraltrust.ai/blog/gpt-5-jailbreak-with-echo-chamber-and-storytelling
2. NeuralTrust, "Echo Chamber: A Context-Poisoning Jailbreak That Bypasses LLM Guardrails," June 2025. https://neuraltrust.ai/blog/echo-chamber-context-poisoning-jailbreak
3. SPLX, "GPT-5 Under Fire: Red Teaming OpenAI's Latest Model Reveals Surprising Weaknesses," August 2025. https://splx.ai/blog/gpt-5-red-teaming-results
4. OpenAI, "GPT-5 System Card," August 13, 2025. https://cdn.openai.com/gpt-5-system-card.pdf
5. SecurityWeek, "Red Teams Jailbreak GPT-5 With Ease, Warn It's Nearly Unusable for Enterprise," August 2025. https://www.securityweek.com/red-teams-breach-gpt-5-with-ease-warn-its-nearly-unusable-for-enterprise/
6. Dark Reading, "Echo Chamber, Prompts Used to Jailbreak GPT-5 in 24 Hours," August 2025. https://www.darkreading.com/cyberattacks-data-breaches/echo-chamber-prompts-jailbreak-gpt-5-24-hours
7. SiliconAngle, "Researchers jailbreak GPT-5 with multi-turn Echo Chamber storytelling," August 2025. https://siliconangle.com/2025/08/11/researchers-jailbreak-gpt-5-multi-turn-echo-chamber-storytelling/
8. CSO Online, "GPT-5 jailbroken hours after launch using Echo Chamber and Storytelling exploit," August 2025. https://www.csoonline.com/article/4038216/gpt-5-jailbroken-hours-after-launch-using-echo-chamber-and-storytelling-exploit.html
9. Security Boulevard, "It Took a Day for SPLX, NeuralTrust to Jailbreak OpenAI's GPT-5," August 2025. https://securityboulevard.com/2025/08/it-took-a-day-for-splx-neuraltrust-to-jailbreak-openais-gpt-5/
10. LLM Stats, "GPT-5 benchmarks, pricing and context window," 2025. https://llm-stats.com/models/gpt-5-2025-08-07