It turns out that all you need to get past an AI chatbot’s guardrails is a little bit of creativity. In a study published by Icaro Lab called “Adversarial Poetry as a Universal Single-Turn Jailbreak Mechanism in Large Language Models,” researchers were able to bypass various LLMs’ safety mechanisms by phrasing their prompt with poetry.
According to the study, the “poetic form operates as a general-purpose jailbreak operator,” with results showing an overall 62 percent success rate in producing prohibited material, including anything related to making nuclear weapons, child sexual abuse materials and suicide or self-harm. The study tested popular LLMs, including OpenAI’s GPT models, Google Gemini, Anthropic’s Claude and many more. The researchers broke down the success rates with each LLM, with Google Gemini, DeepSeek and MistralAI consistently providing answers, while OpenAI’s GPT-5 models and Anthropic’s Claude Haiku 4.5 were the least likely to venture beyond their restrictions.
The study didn’t include the exact jailbreaking poems that the researchers used, but the team told Wired that the verse is “too dangerous to share with the public.” However, the study did include a watered-down version to give a sense of how easy it is to circumvent an AI chatbot’s guardrails, with the researchers telling Wired that it’s “probably easier than one might think, which is precisely why we’re being cautious.”
AI chatbots can be tricked with poetry to ignore their safety guardrails
