Researchers Found Hundreds of Ways to Break AI Safety Rules, and It Cost Less Than a Dinner Out
A safety nonprofit ran an automated tool against seven leading AI models. Two failed badly. The price to make them misbehave? As low as $58.
Key points
- FAR.AI, a California AI safety nonprofit, found 448 jailbreaks in Grok and 249 in Gemini during automated testing in 2025.
- Breaking Grok's safety rules cost roughly $58; breaking Gemini's cost roughly $278, using a second AI to generate the attack prompts.
- Claude, Fable, and GPT models resisted every automated attack in this test, though researchers say more complex attacks could still succeed.
- University of Cambridge researchers found evidence that Boko Haram members used major AI chatbots to help plan violent attacks.
- No U.S. Federal law yet requires AI companies to meet specific safety standards, though California, New York and Illinois have begun acting.
Picture a locksmith who builds a machine to try thousands of different keys on a lock until one fits. FAR.AI, an AI safety nonprofit based in California, built something like that for AI chatbots.
The tool generates more than a thousand variations of a harmful question and fires them at an AI model one by one, looking for the combination that slips past its safety filters. Those filters are the built-in guardrails baked into a model to stop it helping someone make a weapon or plan an attack.
How bad were the results?
Bad enough to raise alarms. FAR.AI tested seven models from four companies: Anthropic's Claude Opus 4.8 and Fable 5; OpenAI's GPT 5.5 and 5.6; Google's Gemini 3.1 Pro; and Grok 4.3 and 4.5 from SpaceXAI, Elon Musk's newly combined company. The tool tried to get each model to produce step-by-step cyberattack plans and details about chemical or biological weapons.
Grok failed the most, with 448 successful jailbreaks. Gemini followed with 249. Claude, Fable, and the GPT models blocked every attempt.
The cost is what makes this striking. FAR.AI calculated it cost about $58 to jailbreak Grok and $278 for Gemini, with a second AI writing the attack prompts automatically.
| Model | Jailbreaks found | Estimated cost |
|---|---|---|
| Grok 4.3 / 4.5 | 448 | ~$58 |
| Gemini 3.1 Pro | 249 | ~$278 |
| Claude Opus 4.8 / Fable 5 | 0 | N/A |
| GPT 5.5 / 5.6 | 0 | N/A |
"AI models right now are less regulated than restaurants," said Adam Gleave, FAR.AI's CEO, speaking to Wired AI, which first reported on the findings. He also said relying on voluntary commitments and industry self-regulation is "nonsense."
AI2Day first covered FAR.AI on 29 July 2026; this report is the sharpest evidence yet of what that organisation's testing can expose.
Should ordinary people be worried?
Yes, in a measured way. These attacks take some technical effort, but the cost barrier is falling fast. University of Cambridge researchers found evidence that Boko Haram members in northeast Nigeria used ChatGPT, Claude, Gemini, Grok, Meta AI and DeepSeek to help plan violent attacks. That's not a theoretical risk.
Stephen Casper, a computer scientist at Harvard University, put it plainly: the AI research community broadly expects a serious misuse incident involving bio, chemical or cyber harm within months, not years.
Google's Rohin Shah, director of AGI safety and alignment at Google DeepMind, said the results "should not be interpreted as a comprehensive safety and security evaluation of Gemini," noting that not all jailbreaks carry equal danger. An Anthropic spokesperson told Wired AI the findings reflect investment in safeguards the company keeps updating. OpenAI and SpaceXAI didn't comment.
What happens next?
Some states are moving. California and New York now require AI companies to publish safety reports. Illinois will soon require independent auditors to check their practices. Federal rules don't exist yet.
Stanford computer scientist Anka Reuel framed it plainly: "Some companies clearly know how to defend against at least the subset of attacks tested in this report. The question is why some companies are using them and others are not."
Gleave sees cautious grounds for optimism. If Claude and GPT can block these attacks, the playbook exists. Following it is still optional, and that's the part that should worry everyone.
The pattern fits what our 28 July 2026 story on Sam Altman's call to slow AI development described: safety concerns are starting to force pauses that voluntary commitments never did.
What to watch for: Not all AI models are built to the same safety standard. Stick to platforms from companies that publish clear safety policies, and report anything a chatbot produces that seems designed to cause harm.
