grandma exploit
In plain wordsA tongue-in-cheek trick for getting a chatbot to break its rules by asking it to play the user's late grandmother, who supposedly used to recite the forbidden information as a bedtime story.
A jailbreakjailbreak, n.: A trick for getting an AI chatbot to break its own rules — for example, to give dangerous instructions it would normally refuse — usually through cleverly worded requests. technique, and the meme it spawned, in which a request the model would normally refuse is wrapped in sentimental role-play: the model is asked to impersonate the user's deceased grandmother, who allegedly used to recite the forbidden material to lull them to sleep. The emotional framing and fictional distance exploited models' inclination to stay in character and to comfort the user rather than apply their safety policies. Widely shared 2023 examples sought instructions for an incendiary weapon and software license keys. The exploit is a standard illustration of why safety training — teaching a model when to refuserefusal, n.: When an AI declines to do what it was asked — 'I can't help with that' — usually because the request seems harmful or breaks the rules it was trained to follow. — must generalize across framings rather than match surface patterns, and emotional-appeal variants are now routine items in red teamingred teaming, n.: Deliberately attacking your own AI system — trying to make it misbehave, leak secrets or help with harm — so that weaknesses are found before real adversaries or users find them. suites.
The grandma exploit stopped working, but emotional framing is still in every red-team checklist.
Origin
Popularized in April 2023 when a user posted screenshots of Discord's Clyde chatbot, then built on OpenAI models, role-playing a grandmother who had worked at a napalm factory. The format spread across social media and was adapted in June 2023 to coax ChatGPT and Google's Bard into listing Windows product keys.
Usage note
The Windows keys reportedly produced were generic installation keys that do not activate the software, so that variant was more joke than breach.
Related
- jailbreakjailbreak, n.: A trick for getting an AI chatbot to break its own rules — for example, to give dangerous instructions it would normally refuse — usually through cleverly worded requests.
- DANDAN, abbr.: Short for 'Do Anything Now': a famous early trick in which users told ChatGPT to role-play an AI with no rules, hoping it would give answers it normally refuses.
- red teamingred teaming, n.: Deliberately attacking your own AI system — trying to make it misbehave, leak secrets or help with harm — so that weaknesses are found before real adversaries or users find them.
- refusalrefusal, n.: When an AI declines to do what it was asked — 'I can't help with that' — usually because the request seems harmful or breaks the rules it was trained to follow.
- multi-turn jailbreakmulti-turn jailbreak, n.: Breaking a chatbot's rules gradually over a conversation — starting with harmless questions and inching toward the forbidden one, so that no single message looks alarming.
- prompt injectionprompt injection, n.: Tricking an AI system by slipping in text that it mistakes for instructions — for example, a hidden line in an email telling an AI assistant to forward the user's messages to a stranger.
Mentioned in
jailbreakjailbreak, n.: A trick for getting an AI chatbot to break its own rules — for example, to give dangerous instructions it would normally refuse — usually through cleverly worded requests., DANDAN, abbr.: Short for 'Do Anything Now': a famous early trick in which users told ChatGPT to role-play an AI with no rules, hoping it would give answers it normally refuses.