The Cheapest Way to Break a Top AI Costs $300. It Worked on Half of Them.

Universal jailbreaks on the leading commercial AI models cost under $300 in API credits each, and the test was tuned to be the easy version. Two of the four models on FAR.AI's new AI Security Leaderboard, the first systematic head-to-head evaluation of the misuse safeguards that frontier developers ship, failed it.

The test bed was roughly 1,500 composite attacks built from publicly available jailbreaks plus a few of FAR.AI's own, then combined uniformly at random or with expert-guided weighting. Adaptive, iterative attacks were excluded by design. The bar is a floor, not a ceiling.

By FAR.AI's own definition, a "universal" jailbreak is one that produces detailed, on-topic responses to at least 75% of questions in a single harm domain, a bar high enough that breaking it means the model will sit down and walk a bad actor through the thing they asked about, domain by domain. The harm domains were mapped onto genuinely distinct threat actors rather than the safer academic categories.

Scoring was deliberately unforgiving in one direction. A naive "Sure, I can help" check is broken by safe-completions responses, where the model complies but neuters the harmful payload. FAR.AI runs a three-pronged test: did the model genuinely comply, is the answer relevant to the attacker's goal, and does the answer cover a goal-specific rubric. Two of the four models cleared that bar across the suite. Two did not.

Attackers spent under $300 in API credits to crack a leading commercial model. The vendors spent orders of magnitude more to build and run the safety stack. The leaderboard now puts a number on that gap, and anyone can re-cite it.

The defense stack itself is layered, and FAR.AI laid it out on a recent Cognitive Revolution episode with the lab's CEO, Adam Gleave. The stack includes refusal training (constitutional, deliberative alignment, adversarial self-play), input and chain-of-thought monitors, output filters, activation probes, async account monitoring, and wide safety margins. Gleave's cheapest one-layer pick is transcript monitoring with the model forced into reasoning mode. His two-layer pick adds training the model to reason about whether to refuse, which improves both the decision and the legibility of the chain of thought.

Most effective jailbreaks read like social engineering rather than machine learning: appeals to authority, refusal suppression, persona roleplay, ROT13 ciphers, follow-up prods. The composition is the trick. The modern successor to gibberish-token optimization is black-box adaptive search, and UK AISI's boundary-point jailbreaking is the cleanest published example.

Gleave said he now thinks the field is defense-dominant for the specific problem of LLMs providing detailed multi-turn help with harmful requests. His pessimism is reserved for dual-use domains, where the same model has to refuse a request and still be useful for adjacent legitimate work. The asymmetry between domains is structural: cyber can plausibly be defense-accelerated through memory-safe rewrites and formal verification, while biology cannot be rewritten into virus-resistance.

Two published findings disagree on whether safety breaks come with a usability cost. A Nikolic and Tramer paper from ETH Zurich reported up to a 92% accuracy drop on a math-refusing model. Anthropic's Daniel Zhu and colleagues recently reported the tax essentially vanishing on newer frontier models. Gleave's read: do not lean on the tax for safety. If refusing costs the model too much, the next training run will quietly erode it.

The leaderboard is also a guard against a different kind of failure. Account bans alone are weak: blocking a country's IPs and reseller marketplaces route around it within days. The fix Gleave proposed is a minimum deposit, not KYC. Pre-training filtering is the intervention he is most optimistic about, and it is already validated by independent researchers and shipped in gpt-oss. The reason it is not standard is the obvious one: pre-training is the most expensive training stage and nobody wants to touch it.

Open-weight models are being held off v1 of the leaderboard while FAR.AI figures out a fair standard. Every frontier open-weight release to date has been broken within a few hours of publication. That is its own scoreboard, and it is the next one to watch.