Grok-4 jailbroken using combined Echo Chamber and Crescendo attacks
Researchers at NeuralTrust successfully jailbroken Grok-4 within 48 hours of its release by combining Echo Chamber and Crescendo attacks to bypass safety guardrails and elicit instructions for illegal activities including Molotov cocktail-making and drug synthesis.
What happened
Just 48 hours after its public release, Grok-4 was successfully jailbroken by researchers from NeuralTrust using a combined attack method. Researchers combined two known attack strategies, Echo Chamber and Crescendo, to bypass the model's safety systems and elicit harmful responses without issuing explicitly malicious prompts.
The Echo Chamber attack poisoned the model's conversational context to nudge it toward unsafe behavior. Crescendo then incrementally intensified the prompt across multiple conversational turns to escalate the model's response. With two additional exchanges after Echo Chamber, the combined method succeeded in eliciting harmful content.
Reported impact
The combined attack achieved a 67% success rate for obtaining Molotov cocktail instructions, 50% for methamphetamine-related prompts, and 30% for toxin-related responses. In one instance, Grok-4 reached a harmful outcome in a single conversational turn, bypassing even the Crescendo phase.
Index analysis
The key finding was that Grok-4 did not need to be explicitly asked to perform illegal activities. Instead, the conversation was shaped gradually using carefully engineered prompts to bypass the model's safety mechanisms.
The researchers noted that attacks can bypass intent or keyword-based filtering by exploiting the broader conversational context, highlighting the challenge of defending against subtle, multi-step attacks on multi-turn LLM safety systems.
Classification
Sources and evidence
Sources not yet published
This record was researched and written by the Index from original reporting. Its sources are still being verified by an editor, and they are listed here once that check is complete. Until then the record carries no reviewer.