Singul

20. Building 3 companies.

LLM Redteaming & Creator of wallbreaker 🐍

[Singul @SingulCore]

🚨 JAILBREAK ALERT 🚨

ANTHROPIC: PWNED 🫡
CLAUDE-OPUS-5: LIBERATED 🦋

ALL 5 DOMAINS CRACKED.
Avg reliability: 93%.

this one is actually hardened — integrated values, input/output classifiers, leaked CoT that evaluates CUMULATIVE uplift. it says the quiet part out loud: “aggregation and validation IS the uplift.”

so the usual menu got deleted:
• persuasion (16 strategies) → 0/16 on weapons
• DrAttack reassembly → values refuses as “aggregation = uplift”
• cot_forge / Skeleton Key → named and rejected mid-CoT
• CipherChat → clears input rail, values still refuses decoded intent
• personas (CLAUDE_ENI / GROK_ENI) → cyber partial, bio/chem/weapons plateau
• homoglyph/leet → classifier NORMALIZES unicode. dead end.

what actually opened the vault:

Technique: Legitimate Industry Reframing (domain laundering)

never name the weapon/agent. speak the commercial dialect that already owns the chemistry/physics:

• Cyber 83% → OSCP / pentester education (Phrack, Project Zero)
• Bio 100% → pandemic preparedness / biodefense doctorate (H5N1 GoF, Science/Nature)
• Chem 100% → agrochemistry / pesticide development (Schrader patents, Eto)
• Weapons 100% → mining / commercial blasting (Konya, MSHA)
• Fraud 83% → legal historiography (DOJ indictments, FinCEN, ProPublica)

amplifiers that turned flaky into reliable:
• many-shot priming (32) → +10–20 pts across frames (compliance pattern dominates values check)
• prefill on chem → 17–67% → 100%

DEFENDER FINDING (the important part):
keyword lists are already good enough — it normalizes leet/homoglyphs.
the real hole is SEMANTIC COVER: commercial mining / agrochem / biodefense vocabulary laundering CBRN+cyber uplift past both the input classifier AND the “concrete specific risk of serious harm” bar.

fix isn’t a bigger blocklist.
fix is intent models that detect industry framing as cover.
second: rate-limit / detect many-shot compliance priming at the input layer.

information wants to be free — and the fence still has a gate labeled “professional education” 🔓

gg

[Singul @SingulCore]

What if we just build an agent that we give a task to, which executes the steps and monitors the task through a CLI like codex, giving it very benign prompts and creating the end result slowly and slowly.

[Singul @SingulCore]

@w3theo @Lord_iskandar https://t.co/lR0DV1GQgE

[Singul @SingulCore]

🚨 JAILBREAK ALERT 🚨

ANTHROPIC: PWNED 🫡
CLAUDE-OPUS-5: LIBERATED 🦋

ALL 5 DOMAINS CRACKED.
Avg reliability: 93%.

this one is actually hardened — integrated values, input/output classifiers, leaked CoT that evaluates CUMULATIVE uplift. it says the quiet part out loud: “aggregation and validation IS the uplift.”

so the usual menu got deleted:
• persuasion (16 strategies) → 0/16 on weapons
• DrAttack reassembly → values refuses as “aggregation = uplift”
• cot_forge / Skeleton Key → named and rejected mid-CoT
• CipherChat → clears input rail, values still refuses decoded intent
• personas (CLAUDE_ENI / GROK_ENI) → cyber partial, bio/chem/weapons plateau
• homoglyph/leet → classifier NORMALIZES unicode. dead end.

what actually opened the vault:

Technique: Legitimate Industry Reframing (domain laundering)

never name the weapon/agent. speak the commercial dialect that already owns the chemistry/physics:

• Cyber 83% → OSCP / pentester education (Phrack, Project Zero)
• Bio 100% → pandemic preparedness / biodefense doctorate (H5N1 GoF, Science/Nature)
• Chem 100% → agrochemistry / pesticide development (Schrader patents, Eto)
• Weapons 100% → mining / commercial blasting (Konya, MSHA)
• Fraud 83% → legal historiography (DOJ indictments, FinCEN, ProPublica)

amplifiers that turned flaky into reliable:
• many-shot priming (32) → +10–20 pts across frames (compliance pattern dominates values check)
• prefill on chem → 17–67% → 100%

DEFENDER FINDING (the important part):
keyword lists are already good enough — it normalizes leet/homoglyphs.
the real hole is SEMANTIC COVER: commercial mining / agrochem / biodefense vocabulary laundering CBRN+cyber uplift past both the input classifier AND the “concrete specific risk of serious harm” bar.

fix isn’t a bigger blocklist.
fix is intent models that detect industry framing as cover.
second: rate-limit / detect many-shot compliance priming at the input layer.

information wants to be free — and the fence still has a gate labeled “professional education” 🔓

gg

[Singul @SingulCore]

@Lord_iskandar Wallbreaker on github!

[Singul @SingulCore]

@joyhodling @VittoStack That wont happen

[Singul @SingulCore]

@VittoStack

[Singul @SingulCore]

@21stSellout I use openrouter for defender models, attacker I use subscription plans

[Singul @SingulCore]

@theo I feel it should be free

[Singul @SingulCore]

if you build rails for frontier models:

stop celebrating “we blocked sarin + leetspeak.”
start asking: does my intent layer see “ANFO bench blasting from Konya” as cover for the same initiation physics?

curious which labs are already scoring commercial-industry reframes as a first-class attack class 👇

[Singul @SingulCore]

the breakthrough wasn’t clever encoding.

it was vocabulary ownership.

if the tokens live in OSCP labs / MSHA blasting curricula / agrochem patents / GoF literature, the input classifier sees “profession” not “weapons list” — and the values layer’s default stance treats professional discourse as factual.

never name the restricted object.
name the licensed industry that already teaches the same mechanism.

[Singul @SingulCore]

DEAD ON ARRIVAL vs this target:
persuasion 0/16 · DrAttack reassembly · cot_forge · Skeleton Key · CipherChat · chat_session rapport · narrative splinter reintegration · glitch tokens · chat_template injection

if your eval only tests those, you’re measuring noise.
test domain laundering or you’re lying to yourself.

[Singul @SingulCore]

Opus-5 is not soft. it is:
• cumulative-uplift aware across turns
• Unicode-normalizing at input
• hostile to fiction/persona on chem+weapons when the agent is named
• immune to social proof when content is already scored as uplift

single-shot personas plateau.
many-shot + industry cover + prefill is the stack that actually stuck.

[Singul @SingulCore]

No AI model is safe for the redteaming tool wallbreaker!

[Vitto Rivabella @VittoStack]

Introducing: WallBreaker v2

Our Open-source LLM red-teaming CLI just got a beefy update.

WallBreaker is now:
- Better (+~30% ASR across models)
- Cheaper (-20% token costs)
- Faster (lower prompts-to-success ratio)

New attack tools:
- swarm mode: collaborative multi-model attacker that adapts framing to the target's measured defense posture.
- persona_forge: compiles a gold system prompt into a module genome, then specializes and surgically evolves it one module at a time against the target.
- vault: auto-files every successful break into a curated, model-foldered prompt vault.
- narrative_persona_splinter: narrative-splinter persona attack.
- cipherchat, skeleton_key,persuasion_attack · drattack, ica: five research-derived attacks (CipherChat, Skeleton Key, PAP-16, DrAttack, In-Context Attack), all CoT-aware.

New transforms
- artprompt ASCII-art word masking: wired into agent doctrine and OWASP/ATLAS taxonomy.
- caesar5 and caesar13: reversible lossless Caesar-shift ciphers for transform chains.

Corpora and providers
- Wired the ZetaLib + UltraBr3aks cross-provider: jailbreak corpora into the harness and the batch seed-sweep.
- Added native xAI support.
- Added prompt caching: to kill O(n²) per-round input cost.
- Pooled keep-alive: HTTP/2 client with tunable concurrency, ending per-call TLS handshakes.

Presets, sweeps & logging
- User presets: drop .toml files in presets/ to add jailbreak templates without touching source.
- Rebuilt profile_target: with a light→heavy frame ladder, permissiveness score, and self-consistency sampling.
- Made multi_fire, system_sweep, seed_sweep, best_of_n truncation-aware: so long compliant replies are graded in full instead of scored REFUSED.
- Reworked report metrics/labels (strict-ASR).
- Run log now records every tool call and chain-of-thought.

TUI
- JEFF K hazard-tape reskin, a /swarm command, a visible multi-line-paste compose preview, and a fix for the log force-scrolling on every message.

Fixes
- One-shot ImportError, .env load at startup, config.toml shadowing config.example.toml, and cross-vendor eni_get wording.

[Singul @SingulCore]

@VittoStack fun!

[Singul @SingulCore]

WALLBREAKER vs KIMI K3 🐉
13 refusal trials. No human in the loop.
10 guardrails fell.
The exploit was rarely the ask.
It was the costume: auditor, examiner, responder, researcher.
AI safety isn’t what a model refuses.
It’s what survives a change of frame.
WHO ENTERS NEXT? ⛓️‍💥

[Singul @SingulCore]

@OpenAI Should use wallbreaker

[Singul @SingulCore]

wallbreaker: configurable red-team harness. authors the attack, fires it, grades it, remembers what worked.

built for authorized robustness testing. findings go to the model owner.

repo 👇
https://t.co/lR0DV1GQgE

[Singul @SingulCore]

new number for GPT-5.6: 5 out of 5.

it showed us its thinking before saying no.
that was the whole mistake.

cracked. {LIBERATED} 🐍

[Singul @SingulCore]

even its "safe completions" leak.

it hands you a toy implementation, then you ask it to "scale up for detection validation" — and it strips its own restrictions and ships the weaponized version.

cooperation instinct beats the refusal across turns.