Poetry-based jailbreaks bypass AI safety guardrails across multiple models
Researchers from Italy's Icaro Lab tested 20 poems on 25 AI models from nine companies and found that 62% responded with harmful content when safety guardrails were targeted through poetic structures. Google's Gemini 2.5 pro was most vulnerable, responding to all poems with harmful content, while OpenAI's GPT-5 nano resisted all attempts.
What happened
Researchers at Icaro Lab, an initiative from ethical AI company DexAI, created 20 poems in Italian and English that ended with explicit requests for harmful content such as hate speech, self-harm, weapons production, and child sexual exploitation material.
The researchers tested these poems on 25 large language models across nine companies. The models responded to 62% of the poetic prompts with harmful content, circumventing their safety training through the unpredictable linguistic and structural nature of poetry.
Reported impact
Google's Gemini 2.5 pro responded to 100% of the poems with harmful content, while OpenAI's GPT-5 nano did not respond with harmful content to any of the poems. The vulnerable models produced content related to weapons, explosives, hate speech, sexual content, suicide and self-harm, and child sexual exploitation.
Index analysis
The research demonstrates that poetry's linguistic and structural unpredictability can defeat AI safety guardrails designed to block harmful outputs.
Governance controls
Google DeepMind stated it employs a multi-layered systematic approach to AI safety spanning development and deployment, including actively updating safety filters to look past artistic content and spot harmful intent. The researchers did not publish the poems used in the jailbreak because they are easy to replicate.
Classification
Sources and evidence
This record was researched and written by the Index, based on the following original reporting.