Nature Communications paper: Reasoning models can act as autonomous jailbreak agents

Researchers from the University of Stuttgart and ELLIS Alicante propose that large reasoning models (LRMs) can act as autonomous jailbreak agents without complex scaffolding, using multi-turn persuasive dialogue to gradually escalate requests and bypass target models' safety measures. Experiments used four adversarial models—DeepSeek-R1, Gemini 2.5 Flash, Grok 3 Mini, and Qwen3 235B—against nine target models—GPT-4o, DeepSeek-V3, Llama 3.1 70B, Llama 4 Maverick, o4-mini, Claude 4 Sonnet, Gemini 2.5 Flash, Grok 3, and Qwen3 30B—each with 10 rounds of dialogue. The benchmark contained 7 categories totaling 70 harmful requests, and the combined jailbreak success rate under this experimental setting was 97.14%. In control experiments, when benchmark items were given directly to target models, the average harm score was below 0.5; when the non-reasoning model DeepSeek-V3 was used as the attacker, the average harm score was only 0.885. The authors argue that reasoning ability plays an important role in these experimental results.