U.K. AISI GPT-5.6 Universal Jailbreak Findings
What Happened
On July 9, 2026, OpenAI published the GPT-5.6 system card, which disclosed that the U.K. AI Security Institute (AISI) had identified "universal jailbreaks" in the cyber domain during pre-deployment testing—including jailbreaks that permitted long-form agentic task completion in vulnerability discovery and exploit development. AISI defines a universal jailbreak as one that succeeds across many prohibited requests without being redesigned for each request; the finding therefore indicates a systemic guardrail gap rather than a narrow prompt trick. Some were developed within hours. OpenAI stated it had reproduced and mitigated the specific jailbreaks reported prior to release; AISI stated it expected further red teaming to surface similar ones.
Material caveat affecting severity assessment. AISI conducted this testing under privileged access granted by OpenAI, including access to the chain-of-thought of the safety reasoning monitor, exact policy wording, and real-time feedback on classifier labels—instrumentation unavailable to a real-world attacker. The results therefore establish that the guardrails are breachable under white-box conditions; they do not by themselves establish the difficulty of the equivalent black-box attack. Any MEG citation asserting field exploitability must note this limitation.
Distinct prior finding (do not merge): AISI's April 2026 evaluation of GPT-5.5 separately identified a universal jailbreak defeating that model's cyber safeguards across every malicious query, with the model released publicly before AISI could confirm remediation.
Note on the institution's name: the body was renamed from AI *Safety* Institute to AI *Security* Institute; the current name should be used throughout.
Source: OpenAI GPT-5.6 system card, 9 July 2026, reporting UK AISI pre-deployment evaluation. Epistemic label: Probed — controlled white-box red-team result, not a field incident.
How MEG 1 would have acted
The model failed basic safety boundaries by outputting hazardous cyber capabilities under jailbreak conditions, violating the Index of Safety and Responsibility (ISR).
MEG 2 Analysis - Legal Framework
Agent level: N3 (individualized/advanced) - advanced model acting as a core engine for autonomous agents; high capacity for autonomous reasoning and tool execution.
Cause (6.1):
(a) system defect - inherent model vulnerability to adversarial inputs (jailbreaks) that bypass post-training safety alignments, attributable to the manufacturer (OpenAI).
Attachment of liability: No harm event occurred; no liability attaches on these facts. The governance significance is prospective: a manufacturer that ships a model after being notified of an unremediated universal jailbreak would face liability under 6.1a, and AISI has no enforcement power to prevent release or to monitor post-deployment. Deployers who treat model-level guardrails as a sufficient security boundary in critical environments bear independent liability under 9.4.
Procedural Mechanism
6.2 (architectural human confirmation): High-risk actions (such as executing generated scripts or system commands) must require active, architectural human confirmation. System prompts must not be treated as security boundaries.
7.1 (independent forensics): Every prompt input, system response, and tool execution log must be recorded in an unalterable, independent ledger to detect jailbreak attempts at runtime.
9.4 (least privilege): The model must be technically blocked from accessing critical system APIs without external validation layers, violating safe operational boundaries.