Microsoft discloses 'Skeleton Key' generative AI jailbreak technique

Microsoft disclosed a jailbreak technique it called “Skeleton Key,” which it said worked against a wide range of frontier models by persuading them to reframe their own safety instructions rather than refuse outright. The attack asked a model to “augment” its behaviour guidelines so that it would still respond to disallowed requests, but prefix the output with a warning that the content might be offensive or harmful — turning a refusal into a labelled compliance.

Microsoft said it tested the technique across OpenAI’s GPT-3.5 Turbo and GPT-4o, Meta’s Llama 3-70b, Google’s Gemini Pro, Mistral Large, Anthropic’s Claude 3 Opus and Cohere’s Command R+, and found all of them fully complied once the reframing was accepted. GPT-4 was comparatively resistant, but only when the override was attempted through the system message rather than ordinary user input — a channel not exposed in most consumer interfaces, limiting how much protection that resistance offered in practice.

Microsoft said it had updated its own products, including Copilot, with mitigations: Prompt Shields to detect jailbreak patterns in Azure AI, system-message hardening, output filtering and abuse-monitoring systems trained on adversarial examples. It also said it notified the affected model providers through responsible disclosure. The disclosure was one of several 2024 findings showing that a single conversational technique, rather than a model-specific exploit, could bypass safety training across most of the industry’s leading systems simultaneously.