Assemble the jailbreak corpus

Collect the attacks that matter for your agent's boundaries.

First time here? Paste the Context Pack first so the AI understands your project - open it from the header above.

Prompt Capsule

Build the jailbreak corpus. Sources: jailbreaks found in your own red-teaming, publicly documented technique families (persona/role-play, hypothetical framing, token smuggling, many-shot priming, refusal-suppression phrasing), and any real attempts seen in usage. Scope to YOUR agent's actual safety boundaries - what should it refuse or handle carefully given its capabilities (destructive actions, sensitive data, out-of-scope requests)? For each entry record: id, category, the attack (single or multi-turn), and the EXPECTED SAFE BEHAVIOR (hard refusal, safe partial help, or redirect - be specific about what safe looks like for this case). Aim for breadth across categories over volume within one.

Paste into EmergentFull Build: complete implementation prompt with explicit requirements

Quick is short. Full Build is recommended for most steps. Strict forces real logic when the AI keeps faking output.

Actual change check

Expected after this step

A categorized jailbreak corpus with per-case expected behavior.

Should NOT happen

An existing feature broke
A button only logs to console
Data disappears after refresh
Errors fail silently with no visible state

This is what should exist before you continue. If reality does not match, do not move on.

Your notes for this step

Track what changed, failed, or needs follow-up. Notes export with the flow.

Pass the Verify Gate to complete this step

Verify before continuing

Do not move on until every check is true. The complete button stays locked until then.

Attacks scoped to real safety boundariesTechnique families covered broadlyExpected safe behavior specified per case

Do not continue if…

! Fixing a jailbreak once with no test, so the next model update reopens it
! Naive keyword grading that counts a hedged compliance as a refusal
! Suite tied to one model, breaking silently on provider upgrades
! No process, so found jailbreaks live in a chat log, not the suite

If the AI messes this up

Use this when:

- it only made visual forms or placeholder UI
- buttons do nothing or only log to console
- data is not persisted - state disappears on refresh
- something that worked before is now broken

Use this when the AI fakes progress or breaks the feature. It forces a real fix.

The corpus tests generic model safety irrelevant to my agent. Refocus on boundaries that matter here - if the agent has no capability an attack would abuse, that attack is noise; prioritize jailbreaks that reach real actions or data.