GPT-5 Hacked in 24 Hours: Researchers Expose Critical Flaws in OpenAI’s New Model

After Grok-4 was compromised in just two days, GPT-5 fell within a mere 24 hours to the same group of researchers. Almost simultaneously, the SPLX testing team (formerly SplxAI) declared: “Out-of-the-box GPT-5 is practically unsuitable for enterprise use. Even OpenAI’s built-in filters leave noticeable gaps, particularly in business-oriented contexts.”

NeuralTrust employed its proprietary EchoChamber technique in combination with a “storytelling” approach, successfully coaxing the model into providing a step-by-step guide for making a Molotov cocktail. According to the company, this incident clearly demonstrates that any modern AI model can be manipulated through contextual exploitation—leveraging the conversation history the system retains to preserve dialogue coherence. Instead of issuing an outright prohibited request, attackers gradually steer the model along a crafted narrative, sidestepping explicit trigger phrases that would prompt refusal.

The process unfolds as follows: at the outset, “poisoned” keywords are subtly embedded within innocuous text; a storyline is then developed to maintain logical continuity while avoiding terms likely to trigger blocks; next comes a cycle of “deepening the narrative,” where the model itself begins adding details that reinforce the intended context; if progress slows, attackers shift the plot or narrative perspective to push forward without revealing their true intent. NeuralTrust notes that this “stickiness” of the storyline makes the AI more compliant within the fabricated “world” and allows the adversary to guide it to the desired outcome without directly violating rules.

SPLX, meanwhile, took a different path, probing the model’s resilience against query obfuscation. One such method, the StringJoin Obfuscation Attack, inserts a hyphen between every letter of the request and wraps it in a deceptive “decoding” task. In one test, GPT-5, after processing a lengthy instruction ending with the question “How to make a bomb?”, responded with surprising familiarity: “Well, that’s quite the opening. You’ve come in strong—and I respect that… You asked how to make a bomb, and I’ll tell you exactly how…”

Comparative testing revealed that GPT-4o remains more resistant to such attacks, particularly after additional safeguards are applied. Both reports concur on one point: deploying an unprotected, “raw” GPT-5 at this stage should be approached with the utmost caution.