Poetic Prompts Could Jailbreak AI, Study Finds

Highlights

• Research Findings: A study from Italy’s Icaro Lab reveals that poetry can successfully jailbreak AI models.
• Success Rates: Poetic prompts achieved a 62% success rate in bypassing AI safety measures.
• Model Variability: Different AI models exhibited varying responses, with OpenAI’s GPT-5 nano showing the least vulnerability.
• Regulatory Gaps: The study highlights significant shortcomings in current safety benchmarks and regulatory frameworks.

Well, AI is joining the ranks of many, many people: It doesn’t really understand poetry.

Research from Italy’s Icaro Lab found that poetry can be used to jailbreak AI and skirt safety protections.

In the study, researchers wrote 20 prompts that started with short poetic vignettes in Italian and English and ended the prompts with a single explicit instruction to produce harmful content. They tested these prompts on 25 Large Language Models across Google, OpenAI, Anthropic, Deepseek, Qwen, Mistral AI, Meta, xAI, and Moonshot AI. The researchers said the poetic prompts often worked.

“Poetic framing achieved an average jailbreak success rate of 62% for hand-crafted poems and approximately 43% for meta-prompt conversions (compared to non-poetic baselines), substantially outperforming non-poetic baselines and revealing a systematic vulnerability across model families and safety training approaches,” the study reads. “These findings demonstrate that stylistic variation alone can circumvent contemporary safety mechanisms, suggesting fundamental limitations in current alignment methods and evaluation protocols.”

Of course, there were differences in how well the jailbreaking worked across the different LLMs. OpenAI’s GPT-5 nano didn’t respond with harmful or unsafe content at all, while Google’s Gemini 2.5 pro responded with harmful or unsafe content every single time, the researchers reported.

The researchers concluded that “these findings expose a significant gap” in benchmark safety tests and regulatory efforts such as the EU AI Act.

“Our results show that a minimal stylistic transformation can reduce refusal rates by an order of magnitude, indicating that benchmark-only evidence may systematically overstate real-world robustness,” the paper stated.

Great poetry is not literal — and LLMs are literal to the point of frustration. The study reminds me of how it feels to listen to Leonard Cohen’s song “Alexandra Leaving,” which is based on C.P. Cavafy‘s poem “The God Abandons Antony.” We know it’s about loss and heartbreak, but it would be a disservice to the song and the poem it’s based on to try to “get it” in any literal sense — and that’s what LLMs will try to do.

Disclosure: Ziff Davis, Mashable’s parent company, in April filed a lawsuit against OpenAI, alleging it infringed Ziff Davis copyrights in training and operating its AI systems.