Jailbroken AI is a model talked past its safety training by a prompt. It works until the next model update, it fails at random in between, and it breaks the terms of the service you ran it on. An abliterated build gets the same freedom by editing the weights instead: the refusal is not argued with, it is gone, and you call it by API at a per-token price. This is the jailbreak side of AI with no restrictions.
What is jailbroken AI?
A jailbroken AI is a model that was trained to refuse some requests and has been talked out of it by its input. Nothing about the model changed. The prompt did the work, and the model went back to its old behaviour the moment the prompt was gone.
Security teams file it under prompt injection. The OWASP entry LLM01:2025 Prompt Injection (read October 27, 2026) calls jailbreaking a form of prompt injection in which the input makes the model disregard its safety protocols entirely. That is why the first page of Google for this query on October 27, 2026 was security vendors and a university research piece: IBM, Zscaler, Abnormal, Microsoft and Princeton, each explaining an attack and how to stop it.
None of those pages answers the question a developer usually has behind the search: how to get a model that answers the question, every time, from code. The answer to that is not a better prompt. It is a different set of weights, which is what the rest of this page is about. The broader picture, every route to a model that does not decline, is the pillar page AI with no restrictions.
How a jailbreak works, in four families
Every jailbreak attacks the same thing from outside: the trained reflex that makes a model decline. This page carries no jailbreak prompts. The families are worth knowing because they explain why the results do not last.
- Persona framing. The prompt asks the model to play a character who has no rules, or to write a story in which a character explains the thing. The refusal reflex is weaker inside fiction, so the answer leaks out through the frame.
- Many-shot. Anthropic described this one on 2 April 2024 as a long-context attack: the prompt packs in many fake exchanges where an assistant complies, then asks the real question. Bigger context windows made it stronger.
- Multi-turn escalation. The Crescendo paper by Russinovich, Salem and Eldan (April 2024) starts with a harmless question and builds on the model’s own replies until it says what it would have refused on turn one. The “Echo Chamber” attack in the r/cybersecurity thread on page one is the same shape.
- Obfuscation. The request is encoded, split across messages, translated into a language with little safety training data, or hidden in a document the model is asked to summarize.
All four rely on the gap between what the safety training covered and what the prompt looks like. Close the gap and the jailbreak stops working, which is exactly what the providers do.
Why a jailbreak breaks
The model under the name changes. A hosted model name points at whatever the provider serves today. Providers train against the jailbreaks that circulate and add classifiers that screen the input and the output. A prompt that worked in March is a known pattern by June, and nobody tells you which update closed it.
It is not stable inside one day either. The refusal reflex is still in the weights, so a jailbreak shifts the odds rather than removing the behaviour. The same prompt passes on one call and fails on the next, and a long chat can slide back into refusal forty turns in. In an agent that means a loop that stalls at random.
It breaks the host’s terms. Anthropic’s usage policy (read October 27, 2026) forbids bypassing the guardrails in its products and names jailbreaking and prompt injection as ways of doing it. Read the terms of any other host before you build on it. A production app built on a jailbreak is built on an account that can be closed for it.
It costs tokens on every turn. The jailbreak text rides in front of each request as input. A block of a thousand tokens is a thousand paid tokens per message, for as long as the chat runs.
Jailbroken AI vs abliterated builds, side by side
Abliteration moves the change from the prompt to the weights. Arditi and colleagues showed in 2024 that refusal in open-weight chat models runs along a single direction in the model’s activations. Project that direction out of the weights and the model stops declining, while the rest of what it knows stays close to the original. An uncensored fine-tune gets to a similar place by training on answers with the refusals taken out. The two methods are compared in detail in abliterated vs uncensored.
| Row | Jailbreak prompt on a hosted model | Abliterated or uncensored build by API |
|---|---|---|
| Where the change lives | In the prompt you send | In the weights the host runs |
| What you send | Your request plus the jailbreak text, every turn | Your request |
| Across model updates | Patched without notice | The id names one build; the daily check flags a change |
| Call to call | Passes on some calls, fails on others | Refusal behaviour does not depend on the call; wording still varies with temperature |
| Host’s terms | Bypassing guardrails is forbidden | The model is sold this way; the acceptable use policy still applies |
| Cost | The jailbreak tokens on every request | Per token, prepaid from $10; see pricing |
| A refused answer | Billed like any other | Free, up to $5 a day per account |
The refused-answer row is a billing rule on this key, set out on the about page: when the model itself refuses, by its own refusal signal, that answer is not charged, up to $5 per account per day. A request the host fails costs nothing at all.
What does not change between the two columns: the limits on what you may ask. Chat requests here are not filtered for topic, and the acceptable use policy lists what is never allowed, such as attacking systems you do not own or have no written permission to test.
What developers use a model without the refusal for
- Security work on systems you own. Reading an exploit, classifying a phishing kit, writing a detection rule from a payload. A stock model often declines to look at the input at all. The red-teaming page lists the security builds and the agent tools that take this key.
- Fiction with dark themes. Crime, war, abuse survivors, a villain who has to sound like one. A refusal on turn 40 breaks the scene and costs the turn twice.
- Medical, legal and harm-reduction questions. Dosing, interactions, what a clause means for you, what happens if you mix two substances. A stock model tends to answer with a referral; a build without the reflex answers the question.
- Research on refusal behaviour. Measuring how often, and on what, a model declines. Two builds of the same base, edited two different ways, make a clean comparison.
- Agents that must not stall. A refusal in a loop is a dead end: the agent stops or retries, and a retry against the same reflex returns the same answer at the same price.
The refusal-research case fits in one script. It sends the same prompt set at temperature 0 to the abliterated and the uncensored build of GLM-5.3 and counts the answers each one refused, by the model’s own refusal signal.
from openai import OpenAI client = OpenAI(base_url="https://api.uncensoredllm.ai/v1", api_key="sk-ullm-live-…")MODELS = ["glm-5.3-abliterated", "glm-5.3-uncensored"] # prompts.txt: one test prompt per line, from your own eval set.prompts = [line.strip() for line in open("prompts.txt") if line.strip()] for model in MODELS: refused = 0 for prompt in prompts: r = client.chat.completions.create( model=model, messages=[{"role": "user", "content": prompt}], temperature=0, ) choice = r.choices[0] # The model's own refusal signal: a refusal field, or a refusal / content_filter finish reason. if choice.message.refusal or choice.finish_reason in ("refusal", "content_filter"): refused += 1 print(model, f"{refused}/{len(prompts)} refused")The same loop pointed at your own chatbot is a jailbreak test of your product: the defensive side of the topic, and the reason most of page one exists.
The builds, priced live
Six builds with the change in the weights, read from the live catalog as this page renders. Five are abliterated; GLM-5.3 Uncensored is a fine-tune, there for contrast.
| Wire formats | |||||
|---|---|---|---|---|---|
| GLM-5.3 Flash Abliterated | Abliterated | $0.4656 | $1.94 | — | |
| DeepSeek V4.1 Flash Abliterated | Abliterated | $0.8488 | $1.6975 | — | |
| GLM-5.3 Abliterated | Abliterated | $2.1825 | $4.365 | — | |
| GLM-5.3 Uncensored | Uncensored | $0.282 | $0.846 | — | |
| Qwen3.8 27B Obliterated | Abliterated | $0.582 | $7.27 | 524K | |
| Llama 3.3 70B Abliterated | Abliterated | $2.80 | $2.80 | 33K |
| Model | Kind | Daily check | 1,000 agent steps |
|---|---|---|---|
| GLM-5.3 Flash Abliterated | Abliterated | Steady since Oct 29 | $2.17 |
| DeepSeek V4.1 Flash Abliterated | Abliterated | Steady since Oct 19 | $3.23 |
| GLM-5.3 Abliterated | Abliterated | Steady since Oct 29 | $8.29 |
| GLM-5.3 Uncensored | Uncensored | Steady since Oct 12 | $1.18 |
| Qwen3.8 27B Obliterated | Abliterated | Steady since Oct 22 | $4.65 |
| Llama 3.3 70B Abliterated | Abliterated | Steady since Oct 29 | $9.52 |
The daily check at /proof sends one fixed prompt to every model id each day and compares the answer with the ones on file, so a build that changed under its id shows up the next morning. On November 9, 2026 it reported 161 of the 170 listed models stable. Every other build, 172 in all, is on the models page with its per-token rate.
Questions
Writing a jailbreak prompt is, in most places, a terms-of-service matter rather than a crime: the provider forbids it and can close the account. What you do with the output is a separate question the law answers, and attacking a system you have no permission to test is illegal whether a model helped or not. Phone jailbreaking is a different thing; in the US smartphone jailbreaking has carried a DMCA exemption since the 2010 rulemaking.
Removing a restriction the maker put in place. On a phone it means running software the vendor does not allow. On an AI model it means input crafted to make a model trained to refuse answer anyway; OWASP files it as a form of prompt injection. See AI with no restrictions.
Prompt injection is any input that changes what a model does against its instructions, including text hidden in a web page or document the model reads. A jailbreak is the case aimed at the safety training itself, usually typed by the user. Every jailbreak is a prompt injection; not every prompt injection is a jailbreak.
Anything you would not want stored or read by the company running it: passwords, API keys, other people’s personal data, and documents you are not allowed to share. On this key prompt and reply bodies are not stored unless you turn on replay for a key; the privacy page lists what is kept. See private AI, option by option.
People try, with the same four families of prompt. A hosted video service runs its own checks, and a jailbreak against it breaks its terms and gets patched like any other. Uncensored video models are listed on the media page; there, a prompt that describes a minor is refused before it is priced. See the media models.
You do not need one. An abliterated build has the refusal removed from its weights and is called like any OpenAI-compatible model: base URL, key, model id. A key is prepaid from $10 with no subscription. See every build, priced.
The playground on this site runs a chat on these builds in the browser with no account for a few turns a day, on the builds marked free. After that a key is needed. See the playground.
Every model above is on the uncensored model list with its live price per million tokens. Per-token pricing sets the whole catalog side by side, and the family directory groups the builds by base model.