UK AISI's 'Boundary Point Jailbreaking' breaks Anthropic and OpenAI's classifier defences

The UK AI Security Institute published a technique it called Boundary Point Jailbreaking, an automated method for finding universal jailbreaks against AI safety classifiers even in “black-box” settings, where an attacker sees only whether an input was blocked, not why. Tested against Anthropic’s Constitutional Classifiers — a defence Anthropic had said withstood thousands of hours of red-teaming without a universal jailbreak being found — the technique raised the average attack success rate from 0% to 25.5%, with a maximum of 39.9%, at a compute cost AISI put at roughly $330 and 660,000 queries. Against OpenAI’s GPT-5 input classifier it did markedly better, reaching an average success rate of 75.6% and a maximum of 94.3%, for about $210 and 800,000 queries.

The method combined two ideas: curriculum learning, which builds up to a harmful request through a graduated sequence of intermediate prompts blending harmful and benign content, and a search for “boundary points” — inputs that sit close to the classifier’s decision edge, where small changes to an attack are most likely to register as progress. Alternating between finding these boundary points and refining attacks against them let the technique improve iteratively even without access to the classifier’s internal scoring.

AISI said it gave both Anthropic and OpenAI advance notice before publication, and that each had developed mitigations specific to the technique; the institute described itself as continuing active collaboration with both labs to test their defences further. AISI framed the finding as evidence that classifier-based safeguards, however well red-teamed, need layered defences and ongoing adversarial testing as attack methods keep pace with them, rather than as a one-off failure specific to either lab’s system.