'Bad Likert Judge' Jailbreak Bypasses Guardrails of OpenAI, Other Top LLMs

Unit 42 details a new LLM jailbreak, *Bad Likert Judge*, that coerces models into judging harmfulness on a Likert scale and then producing examples for each level—allowing attackers to refine the highest-scoring output into harmful content (e.g., hate speech, self-harm, illegal activity, malware generation, and system prompt leakage). Tested across six leading LLMs, the method raised attack success rates by over 60% versus plain prompts, with iterative refinements further increasing risk. The researchers attribute susceptibility to model limitations and context manipulation, and recommend layered content filtering on prompts and outputs, which reduced attack success by an average of 89.2 percentage points.