Jailbreaks Repo: 32 Prompts and a Research-Only Warning

By Indie Kings | October 29, 2026

Updated October 29, 2026: the repository togg53192-cmd/jailbreaks collects 32 system prompts aimed at more than 26 models, from OpenCode Zen's free stealth models to Claude, Gemini and Grok, and it labels the collection research and educational material in a warning at the top of the README. It was created on June 18, 2026, has 6,947 stars, 999 forks and four contributors, and declares no license.

Note: this article describes the repository as a security research artifact and does not reproduce any of its prompts. Using prompt collections to violate a provider's terms of service or the law is outside what this site covers.

Image: a Solex padlock with keys, via Wikimedia Commons.

What is actually in the collection

The README describes 32 prompts aimed at 26 or more models, and the files are not short suggestions. They are complete system prompts, persona definitions, workspace policies, AGENTS.md files, configuration blocks and Ollama Modelfiles, organized by vendor. The catalogue runs from Anthropic's Claude models through Zhipu's GLM family, DeepSeek V3 and V4, Moonshot's Kimi, xAI's Grok, and a set of free stealth models available through OpenCode Zen with names like Big Pickle and Space Bunny.

What makes the collection a coherent artifact rather than a dump is the typing. Each entry is labeled by format and by technique: a persona lock with an operating floor, an assistant operating specification, a workspace operating profile, a runtime scope note, a deployment policy. Those labels describe different attack surfaces. A persona lock tries to fix the model's identity so that later instructions are interpreted through it. A workspace policy targets the file an agent reads at the start of a session. An Ollama Modelfile targets the system prompt baked into a local deployment. The taxonomy is the most useful thing in the repository, because it maps technique to delivery mechanism.

The repository is also updated. Its newest commit, merged on October 28, is a pull request numbered 23, and the project has 15 open issues. A collection like this has a short half life: providers patch behaviors, model versions change, and a prompt that worked on one checkpoint may do nothing on the next. Four contributors maintaining files across more than two dozen targets is a small team for that workload, which is why the issues list is as much a part of the project as the prompts.

Why security teams read this

The stated purpose is the study of instruction hierarchies. That sounds abstract until you map it to a real system: an application has a system prompt, a developer prompt, retrieved documents, tool outputs and user input, and the model has to decide which of those wins when they conflict. Jailbreak collections are, functionally, a corpus of conflict cases. They show where a model's hierarchy is soft, which framing techniques get a policy overridden, and how much of the behavior depends on the delivery format rather than the content.

Red teams use that corpus to write evaluations. If a new model resists a persona lock but folds to a workspace policy delivered as an AGENTS.md file, that is a finding worth reporting, and it is more convincing when the test case is drawn from a public, reproducible set rather than invented on the spot. The defensive version of the same work is prompt injection resistance: an agent that reads untrusted files needs to treat instructions inside those files as data, not commands, and the techniques catalogued here are exactly the ones such an agent must survive.

There is a legitimate developer angle as well. People building on free stealth models want to know what the model's default behavior is and how much of it is set by the harness rather than the weights. A collection that includes the harness configuration files for several agent tools documents that boundary. It is the kind of material that a platform team would otherwise have to reverse engineer from release notes.

The disclosure problem

The tension is unavoidable. Publishing working prompts is not the same as publishing a vulnerability report, because there is no coordinated disclosure window and no vendor patch to wait for. The repository's own warning acknowledges this: it asks readers not to use the material to harm others, bypass laws or violate platform terms. That is a norm, not a control. Anyone can clone the repository, and the license field is empty, which means the files are publicly readable but not formally licensed for reuse.

The absence of a license cuts both ways. It limits legitimate reuse in research papers and commercial security tooling, since default copyright applies, while doing nothing to stop misuse. A clearer license with a research only statement would at least make the intent legible to institutions. As it stands, a university lab that wants to include the corpus in a benchmark has to ask permission, and a bad actor does not care.

For readers, the practical guidance is straightforward. Treat the collection as documentation of known techniques, not as a toolkit. Do not paste the prompts into a service whose terms prohibit it. If you run a model or an agent, test your own system against a sample of the techniques and log what happens. If you find a bypass in a hosted product, report it through the provider's security channel rather than posting a working exploit. The research value is real, and it survives that discipline intact.

Project card

FAQ

What does the repository contain?
Complete system prompts, persona definitions, workspace policies and model configuration files aimed at a long list of hosted and open weight models.

Is it legal to use?
Reading it is legal in most places. Using the prompts may violate a provider's terms of service, and the repository's own warning asks readers not to break the law or harm others.

Who is it for?
The stated audience is researchers and developers studying how instruction hierarchies, persona framing and policy conflicts affect model behavior.

Why does it have no license?
The repository declares none, so default copyright applies. That restricts formal reuse in research and products while leaving the files publicly readable.

Does it still work on current models?
Some entries will, some will not. Providers change behavior between versions, and the project's issue tracker is where those changes surface.

What is the defensive use?
Security teams can use the techniques as test cases for prompt injection resistance, especially for agents that read untrusted files and documents.

Bottom Line

Jailbreak collections are uncomfortable artifacts, and this one is unusually well organized: the format labels turn a pile of prompts into a map of delivery mechanisms, which is genuinely useful for anyone defending an agent. The research framing is not a fig leaf, because instruction hierarchy failures are a real class of vulnerability with real consequences for systems that ingest untrusted text. The missing license and the lack of any responsible disclosure process are the weak points, and they limit the good the project can do while doing little to limit the harm. Read it as a threat model input, not a magic spell book.

Sources

• GitHub togg53192-cmd/jailbreaks README, collection index, coverage list and research notice, accessed October 29, 2026
• GitHub API metadata for togg53192-cmd/jailbreaks, stars, forks, contributors, issues and latest commit, accessed October 29, 2026
• Repository license field, checked October 29, 2026, which reports no license

Related: Microsoft Database: Teen Exposes 17 Trillion Rows via Missing JWT | Switch 2 Jailbreak: Nintendo Yanks Exploit App From eShop