Sparse autoencoders find jailbreaks that transfer across AI labs

Researchers used a sparse autoencoder to find the internal concepts behind jailbreak scenarios, then reused them to raise attack success by up to 18.2 points, per a new paper.

That's a mechanism for jailbreaking, not a lucky prompt. The same discovered scenarios transferred to GPT-5, Claude-Haiku-4.5, and Gemini-3-Flash, three closed models built by different labs. Stacking scenarios together beat any single one and cut the turns an attacker needs.

How they found it

The approach differs from most jailbreak research, which iterates on wording until something works. Concept2Scenario opens the model up instead. The authors trained a sparse autoencoder to represent internal activations as concepts, then traced which concepts suppress refusal when a scenario-wrapped prompt fires. They translated the highest-signal concepts back into natural-language scenarios and tested the results against six existing black-box jailbreak methods across three open models.

The paper doesn't say whether the three affected labs have patched the scenarios it discovered, or whether the technique scales past the concepts the authors found. That gap matters more than the topline number.

The bet worth making: prompt-level defenses tuned to catch specific wording will keep losing to attacks built from a model's own internal representations. An attacker only needs one lab's interpretability tooling to generate scenarios that travel to competitors' models. That's the shift here, from hand-written prompts toward attacks derived from a model's own internals.