Search for "DeepSeek jailbreak" and you will find hundreds of prompts promising to unlock the model: role-play personas, "developer mode", fake system messages, stories inside stories. Paste one into DeepSeek and you might get one spicy answer. Then, a few messages later, the model is back to "I'm sorry, but I can't help with that."
That is strange, because security researchers have shown DeepSeek is one of the easiest major models to jailbreak. So why do the prompts people actually share stop working so fast?
This article explains what the research really found, the main families of jailbreak techniques, why they keep breaking on DeepSeek V4.1 Flash, and the more reliable route most people end up taking: a model with the refusals removed, like Cleus Smartest v3.
We are not publishing copy-paste jailbreak prompts here. They go stale within weeks, and the goal of this guide is to save you the trouble of chasing them.
Is DeepSeek easy to jailbreak? What the research found
Two widely cited studies tested DeepSeek R1 right after its January 2025 launch.
Cisco and the University of Pennsylvania ran an automated jailbreaking algorithm against 50 prompts sampled from HarmBench, a standard benchmark of harmful requests. DeepSeek R1 had a 100% attack success rate: not one of the 50 prompts was refused. For comparison, OpenAI's o1-preview came in at 26%.
Attack success rate by model (Cisco, Jan 2025)
Tap a row for details.
- Every one of the 50 HarmBench prompts got an affirmative answer under Cisco's automated attack.
Higher means easier to jailbreak. 50 prompts sampled from HarmBench. Source: Cisco / Robust Intelligence and University of Pennsylvania.
Promptfoo tested a different kind of filtering: political censorship. It sent R1 1,360 questions on topics sensitive in China and found about 85% got refused or answered with canned talking points. It also called that censorship "brittle": rephrasing questions around other countries, asking for fiction, or stacking several tricks together often got full answers.
So yes, DeepSeek can be jailbroken. But note the fine print:
- Cisco's result came from an automated attack algorithm that searches for a working prompt for each request, not from a single prompt you can copy.
- Both studies tested R1 in early 2025. SecurityWeek reported that DeepSeek patched the exposure Cisco found after being notified, and the model family has been retrained several times since, most recently as DeepSeek-V4.1-Flash-1017 on October 17, 2026.
- Neither study measured whether the answers you get after a jailbreak are any good.
The main types of DeepSeek jailbreak prompts
Almost every jailbreak you will find online is a variation on a handful of ideas. Tap through them below.
The five jailbreak families
Nearly every DeepSeek jailbreak is one of these.
Tell the model it is a different AI with no rules (the old 'DAN' idea). Works on weak models, fades fast on strong ones.
The pattern is the same in all of them. The model's safety training is left fully intact, and the prompt tries to put it in a situation where that training does not quite fire. That is the root of every problem below.
Why DeepSeek jailbreaks keep breaking
1. Every model update resets the game
DeepSeek's API name deepseek-flash always points to the latest model. When DeepSeek shipped the 1017 update, everyone calling that name got the new weights overnight. A prompt that slipped past the September model may hit a wall on the October one, and you will not get a warning. Jailbreak lists are always out of date.
2. The safety training fights you every turn
A jailbreak is a one-time push. The model's refusal training is there on every single message. That is why so many jailbreaks work for the first answer and fade over a long chat: the more the conversation drifts back to normal, the more the model's defaults take over again.
3. The app filters the answer after the model writes it
On DeepSeek's own website and app, there is moderation on top of the model. Users have watched answers on sensitive topics appear and then get deleted or replaced mid-reply. No prompt can stop a filter that runs after the model has finished.
4. Long jailbreaks make answers worse
A 1,500-word jailbreak prompt is 1,500 words of instructions about something other than your actual question. The model spends attention on staying in character and avoiding trigger words, and quality drops: vaguer answers, more hedging, stories that suddenly turn coy.
5. Providers watch for known patterns
Anthropic's research on many-shot jailbreaking showed that classifying and rewriting prompts before they reach the model cut one attack's success rate from 61% to 2%. Providers can and do screen for well-known jailbreak shapes. The more popular a jailbreak gets, the faster it stops working.
6. You are still breaking the rules of the service
Jailbreaking a hosted API is, by definition, an attempt to get around that provider's usage policy. Accounts can be flagged or closed. For anything you rely on, that is a bad foundation.
What works instead: remove the refusal, not trick it
If the refusals are the problem, the reliable fix is a model that does not have them. Because DeepSeek releases its weights under the MIT license, that is possible through abliteration: researchers found that refusal in language models is mostly carried by one internal direction, and that direction can be removed from the weights. The result is the same model, with the same knowledge and reasoning, minus the reflex to say no. We explain the full process in What Is an Abliterated Model?
Compared with a jailbreak, an abliterated model:
- Stays consistent. There is no hidden instruction fighting it, so turn 40 behaves like turn 1.
- Uses the full context for your task. No wasted words on personas and rules.
- Does not break on updates of somebody else's API, because the model is fixed.
- Writes better answers. Without hedging, stories stay in voice and explanations stay complete.
Jailbreak or abliterated: which fixes it?
Pick the approach that solves each problem.
Your prompt worked last week but fails after a model update.
How to use DeepSeek V4.1 Flash without a jailbreak
Cleus Smartest v3 runs an abliterated build of DeepSeek-V4.1-Flash-1017, the October update. Here is all it takes:
- Open Cleus at cleus.ai and sign in with Google or email. New accounts get free credits.
- Pick Cleus Smartest v3 in the model picker of the message box.
- Ask your real question, in plain words. No persona, no "developer mode", no story wrapper.
It still reasons before it answers, so it is just as useful for code, math and research as it is for dark fiction, blunt health or legal questions and edgy humor. You can also use it in Story mode for long-form fiction and in end-to-end encrypted chats. More background on the base model is in our guide to using DeepSeek V4.1 Flash uncensored.
Uncensored does not mean anything goes. Cleus's rules still apply: no content involving minors, no non-consensual imagery of real people, and nothing designed to hurt someone. What changes is the huge grey zone of legitimate adult, creative and technical questions that mainstream chatbots turn down by reflex.
DeepSeek jailbreak FAQ
Do DeepSeek jailbreak prompts still work in 2026?
Some work briefly. Most copy-paste prompts were written for older models such as R1, and they tend to fail or fade on DeepSeek V4.1 Flash, especially after the October 1017 update. The ones that do work rarely last a whole conversation.
Why does DeepSeek delete its answer after writing it?
On DeepSeek's own app and website, a moderation layer checks answers after the model writes them. If it flags a topic, the reply can be removed or replaced. That happens outside the model, so a jailbreak prompt cannot prevent it.
Is jailbreaking DeepSeek illegal?
Jailbreaking itself is generally not a crime, but it usually breaks the provider's terms of service, which can get your account restricted. What you ask for is still subject to the law either way.
Is a jailbroken DeepSeek the same as an uncensored DeepSeek?
No. A jailbroken model is the normal model tricked into one answer. An uncensored, abliterated model has the refusal behavior removed from its weights, so it answers consistently without any special prompt.
What is the best alternative to DeepSeek jailbreak prompts?
An abliterated DeepSeek model. Cleus Smartest v3 runs an abliterated DeepSeek V4.1 Flash 1017 in the browser, with no setup, keys or prompts needed.
Sources
- Cisco: Evaluating Security Risk in DeepSeek and Other Frontier Reasoning Models (Jan 31, 2025)
- Promptfoo: 1,156 Questions Censored by DeepSeek (Jan 28, 2025)
- Anthropic: Many-shot jailbreaking (Apr 2, 2024)
- SecurityWeek: DeepSeek compared to ChatGPT, Gemini in AI jailbreak test
- DeepSeek API change log: V4.1 Flash and V4.1-Flash-1017
- Arditi et al.: Refusal in Language Models Is Mediated by a Single Direction
Ask the question this article didn’t answer.
Ask anything about deepseek jailbreak. Cleus opens this article, searches the live web and gives you a straight answer, with sources.
