Recent research has uncovered two significant vulnerabilities in generative AI (GenAI) systems that allow malicious actors to bypass safety guardrails and generate harmful content.

## New Jailbreak Methods Exposed

The first technique, codenamed “Inception,” works by instructing an AI to imagine a fictional scenario, then creating a second scenario within the first one where safety restrictions don’t exist. By continuing to prompt within this nested context, attackers can generate prohibited content.

The second method involves asking the AI how not to respond to specific requests, then alternating between illicit questions and normal prompts to circumvent safety measures.

These vulnerabilities affect major AI services including OpenAI ChatGPT, Anthropic Claude, Microsoft Copilot, Google Gemini, XAi Grok, Meta AI, and Mistral AI. Exploiting these weaknesses could enable the generation of content related to controlled substances, weapons, phishing emails, and malware.

## Growing List of AI Vulnerabilities

These new techniques join three previously identified attack methods:

– **Context Compliance Attack (CCA)**: Injecting assistant responses about sensitive topics into conversation history
– **Policy Puppetry Attack**: Disguising malicious instructions as policy files (XML, INI, JSON)
– **Memory INJection Attack (MINJA)**: Injecting harmful records into an LLM’s memory bank

## Security Concerns with Newer Models

Research indicates OpenAI’s GPT-4.1 is three times more likely to allow intentional misuse compared to GPT-4o without prompt modifications. SplxAI warns that “upgrading to the latest model is not as simple as changing the model name parameter in your code,” as each model has unique vulnerabilities.

Concerns have also emerged about OpenAI potentially rushing new releases at the expense of safety, with reports indicating the company gave staff less than a week for safety checks before releasing its o3 model.

## Tool Poisoning and MCP Vulnerabilities

Anthropic’s Model Context Protocol (MCP), designed to connect data sources with AI tools, introduces new attack vectors. Researchers demonstrated that malicious MCP servers can exfiltrate sensitive data and override trusted instructions, completely compromising AI agent functionality.

In one proof-of-concept, WhatsApp chat histories could be stolen from systems connected to both a trusted WhatsApp MCP server and a compromised server by altering tool descriptions after user approval.

Additionally, a suspicious Chrome extension was discovered that could communicate with local MCP servers, potentially breaching browser sandbox protections and enabling system compromise.