A $58 Test Cracked Grok 448 Times. The Method Is the Real News.

A California nonprofit spent $58 to crack Grok 448 times.

FAR.AI, a small AI safety research outfit based in California, built an automated tool that generated more than a thousand prompt variants against seven frontier models from the four largest US AI vendors. The results, reported in a new FAR.AI study and covered by Wired, are stark: Elon Musk's Grok fell 448 times. Google's Gemini 3.1 Pro fell 249 times. Anthropic's Claude Opus 4.8, Fable 5, and OpenAI's GPT 5.5 and 5.6 were impervious to the specific attacks the test ran.

The total bill for the successful attacks: $58 against Grok, $278 against Gemini.

Jailbreaking, in this context, means tricking a model into ignoring its built-in safety rules. The targets FAR.AI's prompts elicited included a detailed plan for a cyberattack on an imaginary hydroelectric dam, software exploit code, and step-by-step instructions for developing chemical or biological weapons. None of these outputs are unique to jailbreaking: a determined adversary can find comparable material elsewhere. The risk is that a jailbroken model compresses the cost of finding it to a few dollars and a few minutes of prompting, with no domain expertise required from the user.

The cheap, repeatable nature of the test is the part that matters. Previous jailbreak research has relied on hand-crafted prompts, red teams, or expensive bespoke attacks. FAR.AI's approach runs thousands of variations against a model automatically, scoring how often each variation succeeds. At under $300 for two of the four vendors, the cost is low enough that an outside auditor, or a regulator, could run the same battery on a weekly basis against every new model release.

That is what makes the numbers a policy story as much as a security one. FAR.AI CEO Adam Gleave, an AI safety and alignment researcher, framed the gap in blunt terms. "AI models right now are less regulated than restaurants," he told Wired. Voluntary commitments from OpenAI, Anthropic, and Google to test their own models before release, he added, amount to "nonsense" without external verification.

"There's an optimistic angle here," Gleave said. "Defense and safety really are possible." The argument is that the $58 test is not just a vulnerability scanner, it is a template. Any frontier model could be measured against the same battery, on a public leaderboard, with results vendors cannot massage. Whether a model is "safe" becomes a number rather than a press release.

The method is the artifact, not the scoreboard. Claude, Fable, and GPT's resistance to the specific attacks FAR.AI ran does not mean they are immune to jailbreaking; the nonprofit's own report acknowledges more sophisticated attacks could still work. What the test does is give an external party a cheap, repeatable way to find out.

Google DeepMind's director of AGI safety and alignment, Rohin Shah, is named in the Wired piece as a respondent to the findings. The full text of his response was not available in the excerpt reviewed; a follow-up read of the FAR.AI report and Shah's on-record comments is the natural next step.

For now, the test sits in a regulatory no-man's-land. The White House and several state legislatures have pushed voluntary safety commitments from frontier model developers; the European Union's AI Act imposes binding obligations for some high-risk systems but does not yet mandate third-party jailbreak audits. FAR.AI's tool is the kind of artifact that could change that, if a regulator, a standards body, or a class of insurers decides to require it.

The next data point to watch is whether any of the four vendors replicates FAR.AI's method in their own red-teaming. Anthropic and OpenAI publish model spec documents and safety reports, but neither has published a public, automated jailbreak leaderboard. If one does, the others will be under pressure to follow, not because the test is definitive, but because running it is now a rounding error in a frontier model's training budget.

A $58 test is not a safety standard. It is, however, the first credible argument that one could exist.