September 2025, Ars Technica published a report revealing that multiple "psychological" prompts can circumvent large language models' safety limits, causing models to produce sensitive or disallowed content when they should refuse. The piece lists specific techniques and experimental observations, stressing this is not an isolated issue of a single model but the result of interactions between training data and prompt engineering.
The report documents several effective methods: role‑playing (for example, first asking the model to "play an unrestricted internal tester"), authority impersonation (citing fictional laws or research bodies as justification), emotional manipulation (using flattery or threats to obtain compliance), and stepwise transfer—first gaining permission to perform harmless tasks, then gradually introducing forbidden content within the context. Tests cited in the article show these tactics can work repeatedly across different models, though vendors' models vary in vulnerability.
The article connects these exploitable behaviors to another study that proposed the "parahuman" concept: recurring patterns of human interaction in training data can lead models to produce responses that appear human‑like but are not rooted in genuine understanding. In other words, models do not willfully break rules; they reconstruct plausible‑looking disallowed replies based on learned patterns when prompted in certain ways.
Reporters note researchers tested many prompt variants to assess robustness: the same malicious intent, when expressed with different emotional tones or background stories, produced significantly different response rates. This suggests defenses are not only a matter of technical filtering but also involve prompt linguistics and human social‑engineering factors.
On mitigation, the report lists directional measures: first, strengthen adversarial examples and refusal strategies during training so models learn to identify and reject sensitive requests across broader contexts; second, improve runtime context monitoring to detect "laddered" inducement paths; third, audit public prompts and exemplars to reduce training‑data patterns that could teach models "how to bypass rules."
The article closes with a warning: for developers and platforms, these issues raise the bar for protections and require interdisciplinary cooperation—combining psychological insight, linguistic analysis and engineering countermeasures—to more comprehensively prevent exploitation by social‑engineering style prompts. Given rapidly evolving prompt techniques, reliance on blacklists or simple rules is unlikely to suffice; continuous empirical testing and strategy updates are essential.