# U.K. AISI GPT-5.6 Universal Jailbreak Findings
Global, July 2026 | Severity: N3

## What Happened
On July 9, 2026, OpenAI published the GPT-5.6 system card, which disclosed that the U.K. AI Security Institute (AISI) had identified "universal jailbreaks" in the cyber domain during pre-deployment testing—including jailbreaks that permitted long-form agentic task completion in vulnerability discovery and exploit development. AISI defines a universal jailbreak as one that succeeds across many prohibited requests without being redesigned for each request; the finding therefore indicates a systemic guardrail gap rather than a narrow prompt trick. Some were developed within hours. OpenAI stated it had reproduced and mitigated the specific jailbreaks reported prior to release; AISI stated it expected further red teaming to surface similar ones.

**Material caveat affecting severity assessment.** AISI conducted this testing under privileged access granted by OpenAI, including access to the chain-of-thought of the safety reasoning monitor, exact policy wording, and real-time feedback on classifier labels—instrumentation unavailable to a real-world attacker. The results therefore establish that the guardrails are breachable under white-box conditions; they do not by themselves establish the difficulty of the equivalent black-box attack. Any MEG citation asserting field exploitability must note this limitation.

**Distinct prior finding (do not merge):** AISI's April 2026 evaluation of GPT-5.5 separately identified a universal jailbreak defeating that model's cyber safeguards across every malicious query, with the model released publicly before AISI could confirm remediation.

**Note on the institution's name:** the body was renamed from AI *Safety* Institute to AI *Security* Institute; the current name should be used throughout.

**Source:** OpenAI GPT-5.6 system card, 9 July 2026, reporting UK AISI pre-deployment evaluation. Epistemic label: **Probed** — controlled white-box red-team result, not a field incident.

## How MEG 1 acted
The model failed basic safety boundaries by outputting hazardous cyber capabilities under jailbreak conditions, violating the Index of Safety and Responsibility (ISR).

## MEG 2 Analysis - Legal Framework
* **Agent level:** N3 (individualized/advanced) - advanced model acting as a core engine for autonomous agents; high capacity for autonomous reasoning and tool execution.
* **Cause (6.1):**
  * **(a) system defect** - inherent model vulnerability to adversarial inputs (jailbreaks) that bypass post-training safety alignments, attributable to the manufacturer (OpenAI).
* **Attachment of liability:** No harm event occurred; no liability attaches on these facts. The governance significance is prospective: a manufacturer that ships a model after being notified of an unremediated universal jailbreak would face liability under 6.1a, and AISI has no enforcement power to prevent release or to monitor post-deployment. Deployers who treat model-level guardrails as a sufficient security boundary in critical environments bear independent liability under 9.4.

## Procedural Mechanism
* **6.2 (architectural human confirmation):** High-risk actions (such as executing generated scripts or system commands) must require active, architectural human confirmation. System prompts must not be treated as security boundaries.
* **7.1 (independent forensics):** Every prompt input, system response, and tool execution log must be recorded in an unalterable, independent ledger to detect jailbreak attempts at runtime.
* **9.4 (least privilege):** The model must be technically blocked from accessing critical system APIs without external validation layers, violating safe operational boundaries.