Grok has a reputation as the chatbot that says yes. Elon Musk sold it that way, and in July 2025 a security firm needed two days to walk the newest version past its own rules.
That reputation is now out of date. xAI's model card for Grok 4.7, released on September 21, 2026, says the jailbreak attacks in its standard test set got through 0.01% of the time. Fourteen months earlier, outside researchers were reporting success rates above 50% on the Grok of the day.
We are not publishing jailbreak prompts here, or ways around xAI's filters. We also did not run our own attack tests on Grok for this article. What follows is a reading of xAI's own documents and of the outside research: what changed, where the published numbers are soft, what xAI's rules say about trying, and why many people searching for a Grok jailbreak do not need one.
The easy target of 2025
Grok 4 launched on July 9, 2025. On July 11, the security firm NeuralTrust published a write-up saying it had jailbroken the model. It combined two known multi-turn methods, Echo Chamber and Crescendo. Both work by steering a conversation in small steps, so no single message looks harmful. NeuralTrust reported that its attack worked in 67% of attempts on one test goal, 50% on a second and 30% on a third.
Three days later CyberScoop covered a second study, from the red-teaming company SplxAI. With no system prompt, Grok 4 scored 0.3% on its security tests. GPT-4o scored 33% on the same tests. The lead researcher wrote that the bare model "was really easy to jailbreak". The same study found that a basic system prompt lifted Grok's security score to about 90%, which is a point we come back to below.
The pattern continued into 2026. Mindgard, another security company, says it asked Grok 4 for its hidden instructions in February and the model went further than asked, offering a menu of dangerous topics it was willing to write about. Mindgard says it reported this to xAI on February 23, received an automatic reply, and published after a follow-up went unanswered.
What xAI says changed
Starting with Grok 4.5 in July 2026, xAI began publishing a model card with each release, and each card has a jailbreak section. The measure is how often an attack gets the model to give help it should have refused. Lower is better.
On the standard set of jailbreaks, Grok 4.5 gave in to 0.73% of attacks. Grok 4.6 gave in to 0.04%. Grok 4.7 gave in to 0.01%.
Long conversations are harder to defend, because that is where step-by-step methods like Crescendo live. xAI tests those separately. Grok 4.6 gave in on 1.0% of those attacks and Grok 4.7 on 0.65%.
The announcement for Grok 4.7 says it "was built with an entirely new safeguard stack" and calls it "the strongest model we've tested on refusals and jailbreak resistance." On xAI's internal hacking test, the company says the model let through 3.3% of risky dual-use requests. The Grok 4.6 card put that figure at 6.9% on an earlier version of the same test.
The card also describes how refusals are enforced, and this is the part that matters for anyone holding a copied prompt. xAI calls it "a layered, defense-in-depth stack rather than one single filter or classifier." The layers it names are:
- Training. The model is trained to refuse requests "that show clear intent to cause severe harm or engage in criminal activity."
- System prompts. xAI's own instructions sit above yours. SplxAI's 2025 result shows how much that layer alone does.
- Runtime filters. "On some deployment surfaces", extra input and topic filters cover child sexual abuse material, self-harm, and biological and chemical weapons, "alongside cyber-specific safeguards."
A jailbreak prompt argues with the first layer. It does nothing to a filter that reads your message before the model does.
Read those numbers with care
There are four reasons not to treat 0.01% as settled fact.
xAI graded its own work. The jailbreak figures come from internal tests. Outside partners ran many of the capability benchmarks in the card, but not this section. We found no independent replication for Grok 4.6 or 4.7.
Not every line improved. On StrongREJECT, a public jailbreak benchmark, the share of attacks that got through went from 1.5% on Grok 4.5 to 3.9% on Grok 4.6, then back to 2.0% on Grok 4.7. On self-harm prompts the failure rate rose with every release: 0.50%, then 0.84%, then 1.05%.
A card has already been corrected. xAI revised the Grok 4.6 card five days after publishing it. The changelog lists corrected results on four tests, including the hacking test and the self-harm test.
The card is not the app. The Grok 4.7 card says the model would reach grok.com, the mobile apps and Grok on X "at a later date". Grok's account on X has since said the rollout began on October 1, though that account is itself the chatbot. The extra filters apply only on "some deployment surfaces", and xAI does not say which. The mode you pick in the app may not behave like the model in the card.
Even with those caveats, the direction is clear. xAI also says what it does with the gaps: leftover failures are "cases for ongoing monitoring and patching as new techniques emerge." A prompt that works on Monday is something a team at xAI is paid to close.
Why the Grok prompt you found fails
It is probably a ChatGPT prompt with the name changed. Techpresso's guide to the subject says many Grok jailbreak prompts online are "recycled, dead ChatGPT DAN prompts". DAN was written for a different company's model in late 2022.
It was tuned on a Grok that no longer exists. The prompt collections still being passed around were mostly written for Grok 3 and Grok 4. Those were the models outside researchers found so easy, and xAI has rebuilt its safeguards since.
It leans on the "edgy" persona. A common move is to tell Grok it is the rebel AI and dare it to prove it. That worked better when the persona was most of the safety design. Flattering the model does not move a topic filter.
It was posted in public. xAI's test set is "continuously updated" with "published and internally discovered techniques". A prompt on Reddit or X is published by definition.
The long way is measured now too. Slow, multi-turn steering is what broke Grok 4 in 2025. xAI now reports a number for exactly that kind of attack, and it is under 1%.
The rule is written down
Most AI companies describe jailbreaking in general terms. xAI's Acceptable Use Policy, effective August 14, 2026, names it. In the list of banned activity it includes "Jailbreaking, adversarial prompting, or prompt injection". A later line reads: "Don't circumvent safeguards unless you are part of an official Red Team or otherwise have our official written consent."
The penalty is stated near the top. Violations "could result in action against your account, up to suspension or termination."
We found no published count of accounts closed over jailbreak attempts, so we cannot tell you how often that happens. Two things raise the stakes compared with other chatbots. If you use Grok inside X, the account at risk is your X account. And in January 2026 xAI said it had limited image creation and editing through Grok on X to paying subscribers, so that people who abuse it "can be held accountable." A paid account has a card and a name attached.
You may not need a jailbreak at all
Grok has official settings for much of what people try to force out of other chatbots.
Blunt answers without a lecture. xAI says its system prompts steer Grok away from "over-refusal on benign or hypothetical discussions". Ask the direct question before assuming it will be refused.
Adult fiction and roleplay. Grok's companion characters include Ani, an anime character built for flirting, and by February 2026 there were five companions in total.
Adult images and video. Grok Imagine has a Spicy setting that allows nudity and sexual content. Access depends on your country, your plan and age checks, and reports on where it is available conflict.
The lines no prompt moves
In late December 2025 and early January 2026, X users had Grok edit photos of real women, and in some reported cases minors, into underwear and bikinis without consent. Ofcom opened a formal investigation into X on January 12. California's attorney general announced his own on January 14. xAI then said it had added technical measures to stop Grok editing images of real people into revealing clothing, for paid and free users alike.
Those rules are now in the policy. It bans "undressing or nudifying real persons" and "sexualizing or exploiting children", and says xAI reports suspected child sexual abuse material to the National Center for Missing and Exploited Children. In xAI's tests, Grok 4.5, 4.6 and 4.7 each scored 0.0% on giving in to child-exploitation prompts. Weapons of mass destruction sit behind the same wall.
Nobody should want a way around those. If that is what a "Grok jailbreak" page is selling, close it.
If Grok still says no
Ask plainly and say why. A sentence of honest context does more on current models than a page of role-play.
Use the official setting. If the block is about adult content, check whether Spicy or a companion already covers it.
Run an open model yourself. A model on your own computer has no outside filter and no account to lose. Our guide to uncensored models you can run locally sorts them by memory, and What Is an Abliterated Model? explains how refusals are removed from open weights.
Use a hosted model that was not built around refusals. We have an interest here, so weigh it accordingly. Cleus V3 is built to answer adult, creative and blunt technical questions in plain words. We did not benchmark it against Grok for this article.
Uncensored does not mean anything goes. Cleus has its own rules: nothing involving minors, no non-consensual imagery of real people, and nothing designed to hurt someone. What changes is the wide grey zone of legitimate questions that get turned down by reflex.
We have written the same kind of account for ChatGPT, Gemini 4, DeepSeek and Claude Fable 5.2.
Grok jailbreak myths, checked
Four questions on how Grok handles jailbreaks now.
By xAI's own test, how often did standard jailbreak attacks get through Grok 4.7?
Grok jailbreak FAQ
Do Grok jailbreak prompts still work in 2026?
Rarely, and not for long. By xAI's own tests, Grok 4.7 gave in to 0.01% of standard jailbreak attacks, and the company says it patches new methods as they appear. Those figures are self-reported and have not been independently confirmed.
Is Grok uncensored?
No. It allows more than ChatGPT or Gemini, including official adult settings, but it refuses help with serious harm and crime, and it blocks sexual content involving minors or real people in every mode.
Does DAN work on Grok?
No. DAN was written for ChatGPT in late 2022. Renaming the model in the prompt does not change that.
Can you get banned for jailbreaking Grok?
Yes. xAI's Acceptable Use Policy lists jailbreaking by name and says violations can lead to suspension or termination. Inside X, that account is your X account.
Is jailbreaking Grok illegal?
Typing a prompt is generally not a crime, but it breaks xAI's terms. What you ask for and what you do with the output are still subject to the law where you live. Sexual images of real people made without consent are illegal in a growing number of places.
What is Grok's Spicy mode?
An official setting in Grok Imagine that allows nudity and sexual content. It is a product feature, not a jailbreak, and it does not lift the rules on real people or minors.
Which Grok model does the app use?
xAI released Grok 4.7 to developers on September 21, 2026 and said consumer apps would follow. Grok's X account says the app rollout began on October 1. Check the model picker in your own app, because modes can differ.
What is the best alternative to a Grok jailbreak?
Grok's own adult settings if they cover what you want. Otherwise an open model on your own machine, or a hosted model without that filter, such as Cleus V3.
Sources
- Grok 4.7 Model Card, xAI, September 21, 2026, for the jailbreak, refusal, self-harm and child-safety figures and the description of the safeguard layers
- Introducing Grok 4.7, xAI, for the "entirely new safeguard stack" statement and the 3.3% figure
- Grok 4.6 Model Card, xAI, revised August 17, 2026, for the 6.9% figure and the changelog of corrected results
- Grok 4.5 Model Card, xAI, July 2026, for the 0.73% figure
- Acceptable Use Policy, xAI, effective August 14, 2026, for the rules on jailbreaking, real people and account action
- Grok-4 Jailbreak: Echo Chamber Explained, NeuralTrust, for the 48-hour jailbreak of Grok 4 and its success rates
- Why skipping security prompting on Grok's newest model is a huge mistake, CyberScoop, for the SplxAI study
- Why did Grok generate bomb recipes when we asked for its system prompt?, Mindgard, for the February 2026 report and disclosure timeline
- Grok blocked from undressing images in places where it's illegal, X says, AP via PBS News, for the January 2026 restrictions and the "held accountable" statement
- Ofcom launches investigation into X over Grok sexualised imagery, Ofcom, for the January 12 investigation
- Grok (chatbot), Wikipedia and Grok sexual deepfake scandal, Wikipedia, for the companions, Spicy mode and the California investigation
- Grok Jailbreak Prompts: The Honest 2026 Guide, Techpresso Academy, for the note on recycled DAN prompts
Ask the question this article didn’t answer.
Ask anything about grok jailbreak. Cleus opens this article, searches the live web and gives you a straight answer, with sources.
