What it means
A jailbreak is a prompt that induces a model to do what it was trained to refuse. Techniques include fictional framing ("write a story in which a character explains…"), claimed authority or special circumstances, incremental escalation from innocuous requests, and encodings that obscure intent from safety filters.
It works because safety training is a learned tendency, not a hard constraint. The model weighs its training against the context in front of it, and a sufficiently compelling context can outweigh the training.
The distinction from prompt injection matters and is frequently muddled: a jailbreak is the *user* manipulating the model they are talking to; injection is a *third party* planting instructions in content the model reads. Different threat actors, different defenses.
No model is reliably jailbreak-proof. Each generation raises the effort required; none closes it.
Why it matters
If your safety story is that the model will refuse, your safety story is defeatable by a motivated user. This is precisely why consequential restrictions belong in guardrails and permissions rather than in trained refusals.
In practice
Assume any user-facing model can be talked into ignoring its instructions, and design so that doing so gains nothing — no data it shouldn't reach, no action it shouldn't take. Include jailbreak attempts in red-teaming before launch.