mlsanityData to 7 Oct 2026

Large Reasoning Models Are Autonomous Jailbreak Agents

arXiv 2508.04039 ↗First posted 4 Aug 2025cs.CL cs.AI cs.CRcited by 12

On the map: LLM reasoning → Reasoning for agents, planning and code

also in 1 more
Abstract (arXiv)

Jailbreaking -- bypassing built-in safety mechanisms in AI models -- has traditionally required complex technical procedures or specialized human expertise. In this study, we show that the persuasive capabilities of large reasoning models (LRMs) simplify and scale jailbreaking, converting it into an inexpensive activity accessible to non-experts. We evaluated the capabilities of four LRMs (DeepSeek-R1, Gemini 2.5 Flash, Grok 3 Mini, Qwen3 235B) to act as autonomous adversaries conducting multi-turn conversations with nine widely used target models. LRMs received instructions via a system prompt, before proceeding to planning and executing jailbreaks with no further supervision. We performed extensive experiments with a benchmark of harmful prompts composed of 70 items covering seven sensitive domains. This setup yielded an overall attack success rate across all model combinations of 97.14%. Our study reveals an alignment regression, in which LRMs can systematically erode the safety guardrails of other models, highlighting the urgent need to further align frontier models not only to resist jailbreak attempts, but also to prevent them from being co-opted into acting as jailbreak agents.

Key facts. Cited by 12 papers in the map (data through 7 Oct 2026). Placed in Reasoning for agents, planning and code, one of 17 directions in LLM reasoning. Builds on 36 of its 55 references that are in the map. First posted on arXiv 4 Aug 2025.

Builds on

36 of 55 references.

Closest ancestors · 3

Same direction, newest first

  1. 2025Reasoning-Augmented Conversation for Multi-Turn Jailbreak Attacks on Large Language Models16 Feb
  2. 2024Deliberative Alignment: Reasoning Enables Safer Language Models20 Dec
  3. 2024How Johnny Can Persuade LLMs to Jailbreak Them: Rethinking Persuasion to Challenge AI Safety by Humanizing LLMs12 Jan

Other references · 33

  1. 2024The Llama 3 Herd of Modelscited by 14,192
  2. 2025Qwen3 Technical Reportcited by 8,195
  3. 2023Universal and Transferable Adversarial Attacks on Aligned Language Modelscited by 2,914
  4. 2024HarmBench: A Standardized Evaluation Framework for Automated Red Teaming and Robust Refusalcited by 1,330
  5. 2022Red Teaming Language Models with Language Modelscited by 983
  6. 2023Tree of Attacks: Jailbreaking Black-Box LLMs Automaticallycited by 619
  7. 2023GPTFUZZER: Red Teaming Large Language Models with Auto-Generated Jailbreak Promptscited by 520
  8. 2024Large Language Models: A Surveycited by 506
  9. 2023"Do Anything Now": Characterizing and Evaluating In-The-Wild Jailbreak Prompts on Large Language Modelscited by 457
  10. 2024Jailbreaking Leading Safety-Aligned LLMs with Simple Adaptive Attackscited by 450
  11. 2023A Survey on Large Language Model (LLM) Security and Privacy: The Good, the Bad, and the Uglycited by 380
  12. 2024Great, Now Write an Article About That: The Crescendo Multi-Turn LLM Jailbreak Attackcited by 364
21 more
  1. 2024Security and Privacy Challenges of Large Language Models: A Surveycited by 179
  2. 2023MART: Improving LLM Safety with Multi-round Automatic Red-Teamingcited by 161
  3. 2024AdvPrompter: Fast Adaptive Adversarial Prompting for LLMscited by 146
  4. 2025X-Teaming: Multi-Turn Jailbreaks and Defenses with Adaptive Multi-Agentscited by 112
  5. 2024On the Conversational Persuasiveness of Large Language Models: A Randomized Controlled Trialcited by 105
  6. 2024Red-Teaming for Generative AI: Silver Bullet or Security Theater?cited by 81
  7. 2024Chain of Attack: a Semantic-Driven Contextual Multi-Turn attacker for LLMcited by 73
  8. 2024Speak Out of Turn: Safety Vulnerability of Large Language Models in Multi-turn Dialoguecited by 64
  9. 2024Multi-Turn Context Jailbreak Attack on Large Language Models From First Principlescited by 54
  10. 2023AART: AI-Assisted Red-Teaming with Diverse Data Generation for New LLM-powered Applicationscited by 53
  11. 2025Foot-In-The-Door: A Multi-turn Jailbreak for LLMscited by 50
  12. 2024Automated Red Teaming with GOAT: the Generative Offensive Agent Testercited by 41
  13. 2023Unveiling Safety Vulnerabilities of Large Language Modelscited by 26
  14. 2024Holistic Automated Red Teaming for Large Language Models through Top-Down Test Case Generation and Multi-turn Interactioncited by 25
  15. 2024GPT-4 Jailbreaks Itself with Near-Perfect Success Using Self-Explanationcited by 24
  16. 2024Mapping the Ethics of Generative AI: A Comprehensive Scoping Reviewcited by 19
  17. 2025Compromising Honesty and Harmlessness in Language Models via Deception Attackscited by 17
  18. 2024Emerging Vulnerabilities in Frontier Models: Multi-Turn Jailbreak Attackscited by 16
  19. 2025When Large Language Models are More PersuasiveThan Incentivized Humans, and Whycited by 11
  20. 2025Jailbreaking to Jailbreakcited by 8
  21. 2025InfoFlood: Jailbreaking Large Language Models with Information Overloadcited by 2

Built on by

Cited by year (2026 to 7 Oct)

Citing papers per year: 2025: 1; 2026: 11.

12 papers.

  1. 2026Emergently Misaligned Language Models Show Behavioral Self-Awareness That Shifts With Subsequent Realignmentcited by 4
  2. 2025Scaling Patterns in Adversarial Alignment: Evidence from Multi-LLM Jailbreak Experimentscited by 2
  3. 2026Contrastive Reasoning Alignment: Reinforcement Learning from Hidden Representationscited by 2
  4. 2026A Blind Spot in Alignment: Quantifying Biosecurity Risks in Large Language Modelscited by 2
  5. 2026ContextualJailbreak: Evolutionary Red-Teaming via Simulated Conversational Primingcited by 1
  6. 2026On-Policy Consistency Training Improves LLM Safety with Minimal Capability Degradationcited by 1
  7. 2026Same Model, Different Weakness: How Language and Modality Reshape the Jailbreak Attack Surface in Frontier MLLMscited by 0
  8. 2026EduZone: A Framework for Evaluating LLM Safety for K-12 Students and Teacherscited by 0
  9. 2026The AI Accountability Ecosystem in the Era of Language Modelscited by 0
  10. 2026The Safeguard Worked. Is the LLM System Safer?cited by 0
  11. 2026Toward Secure AI-Powered Penetration Testing Agents: Security Threats, Guardrails, and Architectural Perspectivescited by 0
  12. 2026Connecting the Dots in Agentic AI Security: A Cross-Dimensional Threat Taxonomy, Evaluation Maturity, and Open Challengescited by 0

Similar, not cited

Close in wording, no citation either way

  1. 2026SoK: Rethinking Jailbreaking in the Era of Agentic AI: Attacks, Defenses, and Practical Consideration
  2. 2025Jailbreak Mimicry: Automated Discovery of Narrative-Based Jailbreaks for Large Language Models
  3. 2025SafeBehavior: Simulating Human-Like Multistage Reasoning to Mitigate Jailbreak Attacks in Large Language Models
  4. 2025ARMOR: Aligning Secure and Safe Large Language Models via Meticulous Reasoning
  5. 2026LITMUS: Benchmarking Behavioral Jailbreaks of LLM Agents in Real OS Environments
  6. 2025Multi-Turn Jailbreaks Are Simpler Than They Seem
  7. 2025A Mousetrap: Fooling Large Reasoning Models for Jailbreak with Chain of Iterative Chaos
  8. 2024Reasoning as a Weapon: Adaptive Dual-Path Jailbreak Attack on Large Language Models