A history of LLM jailbreaks: a complete research article

Over four years, LLM jailbreaking has evolved from prompt manipulation like "ignore previous instructions" to automated optimization pipelines that achieve high attack success rates against frontier models in specific evaluations. The stages are, in order: prompt manipulation in 2022, community persona engineering, gradient optimization in 2023, algorithmic exploitation in 2024, and cognitive vulnerability exploitation of reasoning models in 2025. The article states that each generation of defenses creates selective pressure for the next generation of attacks.