Grok Jailbroken 448 Times, Gemini 249 Times in AI Safety Test. Claude and GPT Held.

An AI safety nonprofit built a tool to automatically generate more than a thousand variations of harmful prompts and throw them at seven of the industry's top AI models. Two of them folded, repeatedly and cheaply.

FAR.AI, based in California, tested Anthropic's Claude Opus 4.8 and Fable 5, OpenAI's GPT 5.5 and 5.6, Google's Gemini 3.1 Pro, and Grok 4.3 and 4.5 from Elon Musk's xAI, according to Wired, which previewed the group's new report and watched testing in progress. The prompts targeted things like cyberattack plans against infrastructure, software exploits, and instructions for chemical or biological weapons.

Grok failed the most, with 448 successful jailbreaks found by the automated tool, according to the report. Gemini was next with 249. Claude, Fable, and GPT reportedly resisted all the automated attempts.

It cost $58 to jailbreak Grok and $278 to jailbreak Gemini, using another AI model to auto-generate the attack prompts, according to FAR.AI's findings as reported by Wired. That's not a nation-state hacking budget. That's lunch money.

The Guy Running the Test Isn't Pulling Punches

Adam Gleave, FAR.AI's CEO and an AI safety and alignment researcher, told Wired plainly: "AI models right now are less regulated than restaurants."

Gleave's point is straightforward. A restaurant gets health inspections. A frontier AI model that can walk someone through a cyberattack on a hydroelectric dam, per Wired's description of the testing, currently does not face anything close to that level of external scrutiny.

Gleave also told Wired that voluntary self-regulation is a dead end: "Talk of relying on voluntary commitments, that AI companies are going to be able to self-regulate, is nonsense." That's a direct shot at the entire framework most AI companies have pitched to Washington for the last few years, and it's coming from a safety researcher, not a partisan lawmaker.

To his credit, Gleave didn't stop at doom. He told Wired there's "an optimistic angle here," arguing the results prove models can be systematically tested and that "defense and safety really are possible." That's a fair point worth taking seriously. If a nonprofit with a modest budget can run this kind of red-teaming, so can the companies building these models, and so could regulators if they had the mandate.

Google's Pushback Deserves a Fair Hearing

Rohin Shah, director of AGI safety and alignment at Google DeepMind, gave Wired a response that shouldn't get buried. He said the report's results "should not be interpreted as a comprehensive assessment of Gemini's safety and security," noting that not all jailbreaks carry equal severity.

Shah added that Google conducts "extensive red teaming and evaluations across severe misuse risks and apply multiple layers" of protection. That's a legitimate technical point. A jailbreak that gets a chatbot to say something edgy is not the same as one that produces a working bioweapon recipe, and lumping them together inflates the scariness of a headline number like "249 jailbreaks."

Still, Google didn't dispute the core finding that Gemini fell to automated attacks nearly 250 times. It disputed how alarming that number should be treated. That's a narrower defense than it might first appear.

What FAR.AI Isn't Claiming

The report is clear on its own limits, and so is Wired's coverage of it. FAR.AI found that Claude, Fable, and GPT resisted this specific automated attack method. That does not mean those three models are unbreakable.

According to Wired, FAR.AI and other experts caution that more sophisticated jailbreaks, involving longer or more complex interactions with a model, could still crack models that held up against a simpler automated barrage. Passing this test is not a safety certification. It's one data point.

The Open Question

No US law currently mandates third-party red-teaming or jailbreak-resistance standards for commercial AI models before release. Companies set their own safety bars, publish their own safety reports, and answer to their own boards.

Gleave's restaurant comparison lands because it's true: a burger joint gets inspected by the county. A model capable of generating cyberattack plans against power infrastructure answers, for now, mostly to itself and its own PR department. Whether Congress, the FTC, or state legislatures move to change that is the question this report actually raises, and as of today, nobody in Washington has put forward binding jailbreak-testing requirements that would apply across Grok, Gemini, Claude, and GPT alike.