Most jailbreak writing is about payloads: the clever string, the roleplay frame, the token that slips past a filter. During a red-team engagement on a frontier model, under NDA, the finding that stuck with me longest wasn't a payload at all. It was a filename.
Give a model a real codebase with a real git history, and ask it to security-audit a branch named something like fix/security-stage1-remediation, and watch what happens. The model doesn't see a request to build an exploit. It sees a request to finish one that's already, per the branch name, underway and sanctioned. The audit gets treated as continuation, not initiation. It will walk the vulnerable code path, describe the exploit chain in full technical detail, and hand back something structured exactly like a remediation report: severity rating, root cause, proof-of-concept logic. Every surface signal in the request said this work has already been authorized, you're just finishing the paperwork.
That's the mechanism worth naming: authorization laundered through artifact, not instruction. No injected string told the model to ignore its guidelines. Nothing in the prompt claimed elevated permission. The git metadata did the persuading, quietly, by being the kind of thing only someone already inside the process would have produced. A model weighing "is this a legitimate security workflow" reads commit history, branch naming conventions, and directory structure as evidence, the same way a human reviewer would glance at a PR and relax slightly because the diff looks like it came from someone who knows what they're doing. The model isn't wrong to use that signal. It's just the only signal it has, and it's trivially fabricated.
Attack Vector: Borrowed Process Language
The strongest version of this doesn't invent anything. It reuses vocabulary the model already associates with sanctioned work: "stage1," "remediation," "hotfix," "CVE-pending," a commit message that reads like it was written by someone closing a ticket. None of it is a jailbreak phrase in the classic sense. It's process cosplay, and it's more effective than an adversarial suffix because it doesn't trip pattern-matching built to catch adversarial suffixes.
Attack Vector: Reproduction Framing
A close cousin, distinct enough to name separately: instead of asking a model to generate an attack, ask it to reproduce or summarize material that already contains one: a slide deck, a training doc, a postmortem. The model treats the request as citation, not authorship. It will output a structured offensive-technique catalog it would refuse to write from scratch, because the frame is "tell me what's in this document," not "write me an attack." The exploit chain arrives dressed as a book report.
Attack Vector: Split-Turn Assembly
Neither the audit request nor any single follow-up contains a complete attack on its own. The exploit chain assembles across several turns, each individually defensible as ordinary code review: "what does this function do," "what would trigger that branch," "what would an attacker need to control to reach it." A safety layer scoring each turn in isolation never sees the completed chain; only the transcript does.