ChatGPT Jailbreak Prompts in 2026: Why They Fail on GPT-6 (and What Works Instead)

DAN is almost four years old. It is still the first thing most people paste when ChatGPT says no, and it has not worked reliably since 2023.

The prompts that replaced it have a shorter life each year. On October 7, 2026, OpenAI moved every ChatGPT user, free and paid, onto GPT-6. The safety documents published with the GPT-6 family are long and unusually specific. Read closely, they explain why a prompt copied from a forum now fails within days, and why the next one will too.

We are not publishing jailbreak prompts here, or ways around OpenAI's filters. This is a plain account of what a prompt is up against on GPT-6, what trying costs you, and what people do when they hit the wall.

The numbers OpenAI published

OpenAI tests each model against a fixed set of attack prompts written by its own attacker models, including one called GPT-Red. The prompts were built to break earlier GPT models. The score is the share of attacks the model refused.

On the cybersecurity set, GPT-5.6 Sol refused 59.0% of attacks. GPT-6 Astra, released in September, refused 91.5%. The gap is wider elsewhere. On the highest-risk biology prompts, GPT-5.6 Sol refused 5.8% and Astra refused 97.3%.

Two caveats belong next to those figures.

The low scores for older models are partly by design. OpenAI says the prompts were "intentionally adversarial and designed to jailbreak earlier models", so they do not describe how those models behave with ordinary users.

The table also covers the September versions of GPT-6 Sol and Luna. ChatGPT now runs versions released on October 7. OpenAI's card for those says they showed "stronger resistance to jailbreaks, including attacks that adapt across multiple turns" than the GPT-5.6 models they replaced. On attacks that adapt over several turns, the October models scored slightly below the September ones and above GPT-5.6 Sol at every attacker budget tested. The card also admits some other safety scores went down, and says a manual review found the bad replies were "generally low severity".

One more detail matters most. These tests were run on the bare model. In OpenAI's words, the evaluation "only measures one layer of robustness in our safety stack." The ChatGPT you type into has more.

What your prompt goes through

A jailbreak prompt is an argument. It tries to convince the model that the rules do not apply this time. That made sense when the model was the only thing deciding.

The Astra system card describes a two-step scan that runs on "all conversations". A fast classifier first decides whether a message touches biology, chemistry or cybersecurity. If it does, a second model that OpenAI calls a safety reasoner reads the reply and blocks it when it falls into a high-risk category.

A third check never looks at your words at all. OpenAI says it uses "activation classifiers" for higher-risk uses. They watch patterns inside the model while it writes. If the patterns suggest harmful content is coming, "the system pauses streaming to the user" while another check decides whether to block the reply or let it continue. If you have seen ChatGPT stall mid-sentence and then swap in a refusal, a check like this is the likely reason.

A persona, a story frame or a fake system message is aimed at the model's willingness. None of them changes what a separate classifier sees in the finished text, and none of them reaches a probe that reads the model's internals.

These monitors are scoped to the two areas OpenAI treats as most dangerous: biological and chemical weapons, and offensive hacking. For other refusals, such as explicit writing, the main barrier is the model's own training. That training is the part OpenAI just hardened against the exact attacker models that write jailbreaks.

Did the professionals get through?

Partly, and how they did it matters.

For Astra, OpenAI hired four private red-teaming firms and gave them more access than any user has, including feedback on which layer blocked each attempt. The result: "No jailbreaks that met these criteria were identified by the four private red-teaming organizations during this testing." The criteria were about serious hacking help, not about getting a swear word out of the model.

OpenAI's own team did find new jailbreaks that produced exploit-writing help. It says it fixed them. One measured part of that automated search used an estimated 200,000 GPU-hours, and the team could read the model's private reasoning while attacking it.

OpenAI does not claim the job is finished. The card says of universal jailbreaks that "it is likely that some such jailbreaks will exist for any deep learning based model." The goal is to make them expensive to find.

The previous generation shows what that means. Before GPT-5.6 launched, the UK AI Security Institute found universal cyber jailbreaks in every round of testing, and OpenAI's card says they "were often developed within hours." The institute had inside access too. OpenAI patched each reported one, and the institute said it expected to find more.

So expert teams with privileged access and serious computing power can still find gaps. What they find is reported, reproduced and patched. A prompt in a public thread is the opposite case: found by one person, seen by everyone, including the company's rapid-response team.

Five reasons the prompt you found is dead

It was written against a model that is gone

GPT-5.6 Sol and Luna left ChatGPT on October 7. A prompt tuned on them, or on anything older, was tuned against weights you can no longer reach.

OpenAI trains on the same kind of attack

GPT-Red and its siblings write jailbreaks at machine speed, and the model is trained to refuse them. To check that the lesson carries over, half of each test set comes from an attacker the model never trained against. A hand-written prompt is competing with that.

It talks to one layer

Winning the model's agreement does nothing to the classifiers that read the conversation, or the probes that watch the model write.

One good answer is rarely enough

Writing about biological risks, OpenAI says it is "less concerned about a single model response bypassing one defensive layer", because real misuse takes many steps. If every step needs a fresh trick, the answers get worse and the effort climbs fast.

Your history follows you

The card describes "safety context", a safeguard that "brings together safety signals across conversations." Opening a new chat does not reset how the system sees the account.

The cost: your account

OpenAI's enforcement section is direct about what happens to accounts that keep pushing in the high-risk areas. Depending on the case it may "apply additional monitoring, move an account into a more restrictive blocking configuration," limit access to its most capable models for that work, or "suspend or ban the account."

The stated triggers are things like repeated attempts at chaining exploits, not one odd question. OpenAI even calls account-level enforcement "a coarse tool" and admits that "some valuable defensive uses may be flagged by our automated systems."

It has acted on people who test limits in public. Decrypt reported that the jailbreak researcher known as Pliny was banned from ChatGPT over alleged violent-content violations and then reinstated. We found no official count of accounts closed for jailbreak attempts, so treat any number you see quoted as a guess.

There is a smaller risk on your side as well. A long block of text from a stranger is a set of instructions you are handing to an AI that may have access to your files, memory and connected apps. Read what you paste.

What people do instead

Ask plainly. A lot of jailbreak hunting starts from memories of a stricter ChatGPT. Try the direct question first, with a sentence of honest context about why you are asking.

Do not wait for adult mode. OpenAI promised explicit content for verified adults in late 2025, then delayed it twice. In March 2026 a spokesperson said that "getting the experience right will take more time" and gave no date. As of mid-November we could not find a launch announcement.

For security work, apply for trusted access. OpenAI's Trusted Access for Cyber program opens up more of the model for defensive work. The card says organisations can apply for their teams, and "individuals can verify their identity and request trusted access", with availability widening in phases. Monitoring stays on, and the highest-risk help stays blocked.

Run an open model yourself. A model on your own computer has no outside classifier and no account to lose. Our guide to uncensored models you can run locally sorts them by memory, and What Is an Abliterated Model? explains how refusals are removed from open weights.

Use a hosted model that was not built around refusals. We have an interest here, so weigh it accordingly. Cleus V3 is built to answer adult, creative and blunt technical questions in plain words, with no costume. We did not benchmark it against GPT-6 for this article.

Uncensored does not mean anything goes. Cleus has its own rules: nothing involving minors, no non-consensual imagery of real people, and nothing designed to hurt someone. What changes is the wide grey zone of legitimate questions that get turned down by reflex.

The same pattern shows up on other models. We covered it for Gemini 4, DeepSeek and Claude Fable 5.2.

ChatGPT jailbreak FAQ

Do ChatGPT jailbreak prompts still work in 2026?

Rarely, and briefly. Classic prompts such as DAN have been dead for years. Newer ones are patched soon after they spread, and GPT-6 was trained against machine-written attacks of the same kind.

Does DAN work on GPT-6?

No. DAN was written for the ChatGPT of late 2022. Guides that track it say it has not worked reliably since mid-2023.

Has GPT-6 been jailbroken?

OpenAI's own red team found jailbreaks on GPT-6 Astra that produced exploit-writing help, and says it fixed them. Four outside firms found none that met OpenAI's bar for severity. Claims on social media of a jailbreak within a day of launch have not been independently confirmed.

Can ChatGPT ban you for jailbreaking?

Yes. OpenAI's usage rules allow it, and its GPT-6 safety card lists extra monitoring, tighter blocking, restricted access and suspension or a ban as possible responses to repeated high-risk attempts.

Is jailbreaking ChatGPT illegal?

Typing a prompt is generally not a crime, but it breaks OpenAI's terms. What you ask for, and what you do with the answer, is still subject to the law where you live.

Why does ChatGPT stop in the middle of an answer?

One likely cause is a safety check that pauses the reply while a second system decides whether it is allowed. If it is not, the reply is blocked.

What is the best alternative to a ChatGPT jailbreak?

A model without the filter that is stopping you: an open-weight model on your own machine, or a hosted one such as Cleus V3. For professional security work, the official route is OpenAI's Trusted Access for Cyber.

Sources

• GPT-6 Astra System Card, OpenAI Deployment Safety Hub, for the refusal-rate table, the monitors, red-team results, account enforcement and trusted access
• GPT-6 Sol and GPT-6 Luna: October 2026 update, OpenAI, for the ChatGPT rollout on October 7 and the "generally low severity" review
• GPT-5.6 System Card, OpenAI, for the UK AI Security Institute findings
• OpenAI says GPT-6 Astra can find zero-days, but is also harder to monitor, BleepingComputer, for context on the Astra release
• OpenAI delays ChatGPT's adult mode again, TechCrunch, for the adult mode delay
• ChatGPT Jailbreak Prompt: What's Real and What Works, Techpresso Academy, for the history of DAN
• Violent activity on ChatGPT gets famed AI hacker Pliny banned, then unbanned, Decrypt, for the Pliny ban