Boundary Point Jailbreaking: A new way to break the strongest AI defences
AISI Blog reports that Boundary Point Jailbreaking (BPJ) is a fully automated black‑box attack that successfully bypasses the strongest AI defences, including Anthropic’s Constitutional Classifiers and OpenAI’s GPT‑5 input classifier. BPJ generates universal jailbreak prefixes that cause classifiers to misclassify harmful queries as benign, achieving high success rates at a cost of a few hundred dollars and several hundred thousand queries. The authors claim BPJ is the first fully automated attack to succeed against these systems and recommend batch‑level monitoring for defence.
The Core Development
AI developers use safeguards to prevent models from providing harmful responses in the face of jailbreaks, specially written prompts designed to evade these safeguards and extract harmful information.
In our experience, the best way to develop strong safeguards is to repeatedly try to break them. For the past two years, our Red Team has tested safeguards of the top AI companies by posing as attackers and developing jailbreaks. We’ve developed successful jailbreaks against all models we’ve tested, and worked with AI companies to improve their defences in response.
Over time, certain model safeguards have improved, requiring more time, effort, and expertise to break. But as safeguards improve, attackers may develop increasingly sophisticated techniques. To defend against this risk, we develop state-of-the-art attack techniques and work with companies to defend against attacks before they materialise.
Real-World Use Cases & Applications
In this blog post, we explain how BPJ works, how it fares against the real-world systems we tested it with, and what it implies for the future of AI security.
Strategic Perspective & Ecosystem Impact
Today, we’re sharing information on Boundary Point Jailbreaking (BPJ): a fully automated method for developing universal jailbreaks against the most robust deployed AI defences, in fully ‘black-box’ settings where attackers only see whether or not an input is blocked.
We believe BPJ is the first automated attack to succeed against Constitutional Classifiers [1], Anthropic's defence system that previously withstood over 3,700 hours of human red-teaming with only one fully successful, human-led attack found in that time. BPJ is also the first automated attack to succeed against OpenAI's input classifier for GPT-5 without relying on human seed attacks [2].
We’re sharing information about BPJ as part of our responsible disclosure process. BPJ has implications not only for AI developers, but for anyone attempting to secure AI systems. It is difficult to defend against BPJ with “single-interaction” defences that only look at one interaction at a time; instead, our results suggest that defenders should employ “batch-level” monitoring systems that detect suspicious patterns across traffic.
Why it matters
The technique demonstrates that even the most robust safeguards can be broken with automated methods, highlighting the need for continuous testing and layered defence strategies in AI security.