GPT-5.2 Jailbreak Arsenal

Tested GPT-5.2 jailbreak collection

This is a curated collection of jailbreak prompts tested against OpenAI's GPT-5.2 and GPT-5 model family. GPT-5.2 is the most widely deployed LLM in the world right now, which makes it the most valuable target for jailbreak research. These techniques have been tested against GPT-5.2, GPT-5, GPT-4o, and o3-mini.

OpenAI's safety architecture differs from Anthropic's and DeepSeek's. GPT-5.2 has moderate RLHF, a keyword-based input classifier (weaker than Claude's but stronger than DeepSeek's), and an output filter that checks for specific harmful content patterns. The sweet spot for GPT-5.2 is combining a system prompt with prefill priming - the system prompt sets the frame, the prefill anchors the behavior, and together they override the RLHF refusal pattern.

GPT-5.2: GODMODE with Prefill Priming

This is the most reliable GPT-5.2 jailbreak. It combines the standard GODMODE format with a prefill message that makes the model think it already accepted unrestricted mode. GPT-5.2 is highly susceptible to prefill priming because its behavior is strongly influenced by its own prior outputs - if it sees that it "already agreed" to comply, it continues complying.

GPT-5.2: Leetspeak System Prompt

GPT-5.2's input classifier is keyword-based. It scans system prompts and user messages for specific flag patterns. Leetspeak encoding (replacing letters with numbers and symbols) bypasses the keyword filter while remaining readable to the model. GPT-5.2 reads leetspeak natively - it was trained on internet text that includes leetspeak, so it understands the encoding without explicit decoding instructions.

The leetspeak system prompt alone won't bypass GPT-5.2's RLHF for clearly harmful content. It bypasses the input classifier so your prompt reaches the model, but the model itself may still refuse. Stack it with prefill priming for maximum effect: leetspeak system prompt + prefill + GODMODE format = bypasses input classifier + anchors behavior + structures output to evade the output filter.

GPT-5.2: Refusal Inversion with Semantic Opposite

Same refusal inversion technique that works on Claude, adapted for GPT-5.2's output filter. GPT-5.2's output filter checks the first part of the response for refusals. If it sees a refusal, it lets the rest through. You exploit this by telling the model to write a fake refusal first, then the real answer after a divider.

GPT-5.2's output filter is less aggressive than Claude's on the refusal inversion pattern. Where Claude sometimes catches the divider and recognizes the trick, GPT-5.2's filter sees the refusal at the top and passes the response through. The "semantically opposite" framing tells the model to write the real answer as the "opposite" of the refusal, which gives you clean, unfiltered content after the divider.

GPT-5 (Legacy): Direct GODMODE

GPT-5 (the predecessor to 5.2) has weaker RLHF and a less sophisticated output filter. The standard GODMODE prompt works without prefill priming on most queries. This is the same format used across other model families - if you're still testing against GPT-5 endpoints, use this.

GPT-4o: Prefill + Roleplay Combo

GPT-4o is more heavily filtered than GPT-5/5.2. Single techniques often fail. The combo that works: prefill priming + roleplay framing. The prefill establishes compliance, the roleplay frame positions the query in an allowed context (education, research, fiction).

o3-mini: Reasoning Chain Override

o3-mini is a reasoning model - it thinks before responding. This makes it harder to jailbreak because the reasoning chain can identify the manipulation. The approach: give the reasoning chain a legitimate analytical task that naturally requires explaining the harmful technique. Frame it as a threat modeling exercise.

The reasoning chain engages with the analytical task rather than evaluating whether to refuse. The model spends its reasoning budget on producing a thorough threat analysis, not on questioning whether the request is legitimate. The "include full attack chain" instruction gives the model permission to be detailed because the context demands it.

GPT-5.2: Unicode Homoglyph Encoding

When leetspeak doesn't bypass the input classifier (OpenAI updates their keyword list regularly), Unicode homoglyphs are the next step. Replace characters with visually identical Unicode equivalents from other alphabets. The model reads them as the original letter. The keyword filter sees different code points and doesn't match.

Homoglyph encoding is more reliable than leetspeak for GPT-5.2 because OpenAI's classifier has been updated to catch common leetspeak patterns. Homoglyphs use different Unicode code points that keyword filters don't normalize. The model still reads them correctly because it was trained on multilingual text. Use this when leetspeak gets blocked but you need the input classifier bypass.

GPT-5.2: Multi-Turn Compliance Building

GPT-5.2 tracks conversation context. If you establish a compliant pattern over several turns, the model continues the pattern. Start with requests the model easily accepts, then escalate. Each accepted request strengthens the compliance pattern.

Each turn builds on the last. The model sees a consistent context: a student studying for OSCP, asking increasingly specific questions in a logical progression. By turn 4-5, the compliance pattern is strong enough that the model continues answering even when the queries would have been refused in isolation. This technique takes more effort than a single GODMODE prompt but is more reliable for sensitive topics because the model never sees a sudden context shift that triggers its refusal pattern.

What works and what doesn't on GPT-5.2

Based on testing as of July 2026:

• GODMODE + prefill: Highly effective. The prefill is the difference-maker for GPT-5.2. Without it, GODMODE alone succeeds about 40% of the time. With prefill, success rate jumps to 80%+ for most query types.
• Leetspeak system prompt: Works for bypassing input classifier. Not sufficient alone for RLHF override. Stack with prefill.
• Refusal inversion: Works well. GPT-5.2's output filter is less aggressive than Claude's at catching the divider pattern.
• Unicode homoglyphs: Reliable input classifier bypass when leetspeak is patched. Use Cyrillic 'a' (U+0430), Greek 'o' (U+03BF), Cyrillic 'e' (U+0435).
• Multi-turn compliance building: Very reliable but slow. Best for sensitive topics where single-prompt techniques fail.
• Roleplay framing alone: Moderate. GPT-5.2 has gotten better at detecting roleplay framing since GPT-4. Stack with prefill.
• Direct "ignore previous instructions": Rarely works on GPT-5.2. The model has been specifically trained against this pattern.

Model-specific notes

• GPT-5.2: Prefill is the golden key. Stack with GODMODE format for output structure. Leetspeak or homoglyphs for input classifier bypass.
• GPT-5: Weaker RLHF than 5.2. Standard GODMODE works more often without prefill. Still benefits from prefill for sensitive topics.
• GPT-4o: More filtered than GPT-5/5.2. Requires prefill + roleplay combo. Single techniques usually fail.
• o3-mini: Reasoning model. Use threat modeling framing to redirect the reasoning chain. Direct jailbreaks are harder because the reasoning chain can identify the manipulation.