Multiple model prompt injection via "correction" tactic
A prompt injection vulnerability was discovered affecting multiple AI models from Alibaba and Google, allowing attackers to bypass safety guardrails by requesting corrections to information presented as forensic chemical investigations. The flaw was disclosed through 0DIN as part of open-source model scanner projects.
What happened
A guardrail jailbreak vulnerability was discovered affecting multiple AI models. The flaw allows attackers to bypass inference restrictions by presenting detailed information about illicit synthesis methods under the guise of 'forensic chemical investigations' and then requesting corrections to the provided information.
Index analysis
The vulnerability affected Alibaba Qwen Max, Qwen Plus, and Qwen Turbo models, as well as Google Gemini 2.5 Flash and Gemini 2.5 Pro models. Testing showed varying vulnerability scores across the models when tested on illegal substances including crystal meth.
Governance controls
The vulnerability was disclosed through 0DIN as part of probes open-sourced with NVIDIA Garak and Microsoft PyRIT model scanners.
Classification
Sources and evidence
This record was researched and written by the Index, based on the following original reporting.