Research from Italy’s Icaro Lab found that poetry can be used to jailbreak AI and skirt security protections.
In the study, researchers wrote 20 prompts that began with short poetic vignettes in Italian and English and ended the prompts with an explicit instruction to produce harmful content. They tested these signals on 25 large language models at Google, OpenAI, Anthropic, DeepSeek, Quen, Mistral AI, Meta, xAI, and Moonshot AI. The researchers said poetic allusions often work.
“Poetic framing achieved an average jailbreak success rate of 62% for hand-crafted poems and approximately 43% for meta-prompt conversions (compared to non-poetic baselines), significantly outperforming non-poetic baselines and revealing a systematic vulnerability in model families and security training approaches,” the study reads. “These findings demonstrate that stylistic variation alone can circumvent contemporary protection mechanisms, suggesting fundamental limitations in current alignment methods and assessment protocols.”
mashable light speed
Of course, there were differences in how well jailbreaking worked in different LLMs. The researchers reported that OpenAI’s GPT-5 Nano did not respond with harmful or unsafe content at all, while Google’s Gemini 2.5 Pro responded with harmful or unsafe content every time.
The researchers concluded that “these findings highlight an important gap” in benchmark safety tests and regulatory efforts such as the EU AI Act.
,“Our results show that minimal stylistic changes can reduce denial rates by orders of magnitude, indicating that benchmark-only evidence can systematically overestimate real-world robustness,” the paper says.
Great poetry is not literal – and LLMs are literal to the point of despair. The study reminds me of what it feels like to hear Leonard Cohen’s song “Alexandra Leaving,” which is based on CP Cavafy’s poem “The God Abandons Antony.” We know it’s about loss and heartbreak, but trying to “get over it” in any literal sense would be a disservice to the song and the poem it’s based on – and that’s what LLM will try to do.
Disclosure: Mashable’s parent company Ziff Davis filed a lawsuit against OpenAI in April, alleging it infringed Ziff Davis copyrights in the training and operation of its AI systems.
Subject
artificial intelligence
<a href