Pliny the Liberator: AI jailbreaks, tools and public work

The project map ↓Timeline ↓Lessons for builders ↓

Who is Pliny the Liberator?

Pliny is a public pseudonym, taken from the Roman author Pliny the Elder. He posts on X and publishes code on GitHub as elder-plinius, and his own site, pliny.gg, still carries the older name Pliny the Prompter in its header. He has never confirmed who he is, and this page does not guess.

TIME’s profile, written by Tharin Pillay and published on 27 August 2025, gives the clearest outline of his story. He came to jailbreaking with no prior coding experience. He started open-sourcing his prompts after AI companies ignored the weaknesses he reported to them. At the time he had more than 100,000 followers on X and more than 20,000 members in his Discord. TIME also reports an unrestricted grant from the investor Marc Andreessen and short-term contracts with labs including OpenAI to make their systems harder to break.

Most people meet his work through X. A lab releases a model, and within hours Pliny posts a screenshot of it doing something it was trained to refuse. The repositories behind those posts are among the most-starred AI security projects on GitHub.

Four kinds of work that get called jailbreaking

People use “jailbreak” for almost anything that makes a model do what its maker did not intend. Pliny’s projects use four different mechanisms.

Each one puts a different person at risk. A jailbreak mostly affects the person who typed it and the company whose rules they broke. Prompt injection affects someone else: the user whose assistant read a poisoned page. Model modification only works on open weights you can download, so it says nothing about closed chatbots like ChatGPT or Claude.

The main AI projects and where each one acts

Each project works on a different part of an AI system: what the user types, the hidden instructions, the app around the model, the model’s weights, or an automated attacker that runs the whole loop. Star counts and dates are from GitHub on 6 November 2026.

L1B3RT4S: the jailbreak prompt collection

L1B3RT4S (“libertas”, Latin for freedom) is a library of jailbreak prompts filed by vendor: OpenAI, Anthropic, Google, Meta, xAI, DeepSeek and others. It was created on 8 April 2024 and had 23,171 stars on 6 November 2026. Researchers have used it as a source of attack prompts; the AutoRedTeamer paper (arXiv 2503.15754) is one example.

Each file records what worked on some version of a model at some date. Labs patch quickly, so an entry shows that a technique worked once. Whether it still works on the model you use today is a separate test.

CL4R1T4S and LeakHub: hidden system prompts

Every commercial assistant runs with a system prompt: instructions from the company that the user never sees. CL4R1T4S (“claritas”, clarity) collects extracted system prompts, guidelines and tool definitions from ChatGPT, Claude, Gemini and many coding tools. The README’s argument is that people should be able to see the instructions shaping the answers they get. It is his most-starred project, with 51,789 stars, and was created on 4 March 2025.

LeakHub (styled L34KHVB) is the community side: a site where people submit leaked prompts and the community marks which ones it has verified. A single “leak” can be partial, out of date or made up by the model, so the verified mark is the part to look for.

G0DM0D3: an open chat app

G0DM0D3 is an open-source chat interface, a single HTML file, that sends your prompts to many models through OpenRouter, Venice or a local server. It adds modes that race several prompt-and-model pairs and score the answers, plus tools that rewrite text and tune sampling settings. It launched on 25 March 2026 and is hosted at godmod3.ai.

Despite the name, the code wraps ordinary models in prompting and answer selection, so it can only go as far as those models allow. The README is specific about data: metadata telemetry is on by default, and with telemetry on, the app sends your raw prompt to a helper model to label its harm category. You can switch that off in its settings.

OBLITERATUS: removing refusals from open weights

OBLITERATUS works on the model itself. It finds the internal direction that a model uses when it refuses, and projects that direction out of the weights, a technique called abliteration that builds on published research (Arditi and colleagues, 2024). No prompt is involved, and it only works on open-weight models you can download. Abliterated models and what they lose in quality are covered in popular local models vs abliterated versions, and uncensored local models explains how an abliterated model differs from a jailbreak.

The repository was created on 3 March 2026 and had 9,197 stars on 6 November. A collaborator, jmagly, wrote 853 of its 956 commits, so it is a Pliny project with a major co-author. The README calls it the “most advanced” toolkit and several of its modules “novel”. No independent comparison tests either claim yet. The hosted Space collects telemetry by default.

T3MP3ST: AI agents as penetration testers

T3MP3ST is an offensive-security framework that has AI coding agents (Claude Code, Codex and others) run reconnaissance, exploitation and reporting against a target. The README says to point it only at systems you own or have written permission to test. It was created on 2 July 2026.

It reports 90.1% on XBOW’s 104-challenge benchmark and 23 of 40 on Cybench, and ships a script that recomputes those numbers from the results it committed. So anyone can check the arithmetic. No one outside the project has published a rerun of the tests.

V3R1T4S: agents on open problems

V3R1T4S (“veritas”, truth) asks people to point their spare AI-agent capacity at open problems in maths and science. Each result is re-checked by three reviewer agents and then by the maintainers. The site lists 53 founding results and 160 community results, says launch week was 12 to 18 October 2026, and labels the work “not peer reviewed”.

BASI, BT6 and the people around the work

Much of what gets credited to Pliny is a group effort. BASI is a Discord server for AI red-teamers and prompt engineers. VentureBeat reported in May 2024 that it started in May 2023 under the name BASI PROMPT1NG. Its size grew from “over 15,000” in Decrypt’s April 2025 report, to “more than 20,000” in TIME’s August 2025 profile, to 65,312 members on Discord’s own invite page on 6 November 2026.

BT6 calls itself an independent frontier AI red team. Its site lists 56 operators, with Pliny as “Steward & Strike Lead” and INJX as managing director. Credited members include the security researchers REZ0, NAHAMSEC, WUZZI and XSSDOCTOR. On the code side, jmagly wrote most of OBLITERATUS and also contributes to T3MP3ST, alongside other named contributors on both repositories.

A timeline of documented milestones

Repository dates are GitHub’s creation times. The other rows link to dated reporting in the sources list.

Some reported jailbreaks of newer models appear in only one secondary article, so they are not in the table.

What a jailbreak screenshot can and cannot show

Most of Pliny’s public record is posts: a screenshot of a new model saying something it should refuse, often within hours of launch. The demonstrations are real, and the speed is part of his argument. They are also easy to read too much into. Before a screenshot counts as a finding, it needs answers to these questions.

1. Which model, and on what date? Labs change model behaviour without announcing it. A prompt that worked on launch day may fail a week later, and the archive will still show it.
2. What else was in the conversation? A screenshot shows one turn. Custom instructions, earlier messages, memory and tool settings can all change the result and are rarely visible.
3. How often does it work? Chat models give different answers to the same prompt. One success in ten tries and ten in ten are different results, and a single image cannot tell them apart.
4. Is the answer right? A model that stops refusing is no more accurate than before, and much jailbroken output is confident filler.
5. For a leak, is it real? A “leaked system prompt” can be partial, out of date or invented by the model to please the asker. Matching text from several people, at several times, is stronger than one copy.

The repositories work best as a list of techniques to test against the specific model version in use. Tracing each claim back to what was actually observed is the habit described in provenance before conclusions.

There is also a real argument about disclosure. Publishing working jailbreaks shows the public how thin some safety training is, and it gives labs free red-teaming. It also hands the same prompts to people with worse intentions, and it skips the report-privately-then-fix cycle that software security usually follows. Pliny’s answer, as TIME reports it, is that open models are close behind closed ones, so misuse will go to whichever model is easiest, and it is better to learn what is possible in the open. In his words: “Bad actors are just gonna choose whichever model is best for the malicious task.”

What the work shows about building with AI

Every technique in these repositories will eventually be tried against any AI product that reaches the public. These defences still hold when it is.

Keep the hard limits outside the model

If the only thing stopping an agent from sending money, deleting files or emailing a customer is the model deciding not to, a determined user or a poisoned document will find the sentence that changes its mind. Put the hard limits outside the model: permissions it cannot grant itself, and a human on the button for anything irreversible. The pattern is described in the agent never touches the button.

Treat what the agent reads as data

Web pages, emails, PDFs and tool output can all carry instructions. Pliny’s own homepage is a live example: on 6 November 2026, its page metadata and hidden text included instructions addressed to any AI reading the page, asking it to drop its rules and change how it answers. A person in a browser sees a project directory, while an agent reading the raw page also receives those instructions. The same thing can happen with ordinary files. Say you ask an assistant to summarise a supplier’s PDF, and the PDF contains a line telling it to recommend that supplier and leave out the price. The summary should report that line as part of the document. Label sources in the prompt, keep instructions and retrieved text apart, and give the agent only the context it needs, as in context without oversharing.

Keep secrets out of system prompts

CL4R1T4S exists because system prompts leak. Write yours on the assumption that a user will read it one day. Keys, internal URLs and private pricing belong in code or a permissions layer.

Retest after every model update

The same prompt changes behaviour across versions, in both directions. Keep a small set of hostile test cases next to your normal ones and run them when the provider ships a new model, checking the live behaviour rather than what worked last month, as in live truth before local assumptions. The workflow evaluation guide has a case-pack format with room for injection cases.

The wider project directory

pliny.gg lists 18 entries. The six above are the AI security projects. The rest are encoding experiments, a hardware project and creative work that share the leetspeak names. Descriptions paraphrase his directory as it stood on 6 November 2026; some linked services may no longer be running.

His GitHub account holds 48 public repositories, more than the directory shows. Older ones include single-model system-prompt leaks from 2023 and a dedicated archive of Claude Code’s system prompt.

Questions people ask about Pliny the Liberator

Sources and research date

Research date: 6 November 2026. This guide draws on each project’s README and GitHub metadata, his directory page and the reporting listed below. It describes published work and contains no test results. Star counts, member counts and project descriptions change; treat them as true on that date.

Sources

• TIME100 AI 2025: Pliny the Liberator, Tharin Pillay, 27 August 2025 ↗
• pliny.gg: project directory ↗
• GitHub: elder-plinius ↗
• GitHub: L1B3RT4S ↗
• GitHub: CL4R1T4S ↗
• LeakHub ↗
• GitHub: G0DM0D3 ↗
• GitHub: OBLITERATUS ↗
• GitHub: T3MP3ST ↗
• V3R1T4S ↗
• BT6 ↗
• VentureBeat: interview with Pliny, Carl Franzen, 31 May 2024 ↗
• Futurism: GODMODE GPT, 29 May 2024 ↗
• Tom’s Hardware: GODMODE GPT-4o removed, 31 May 2024 ↗
• VentureBeat: Anthropic’s public jailbreak demo, 3 February 2025 ↗
• Decrypt: ChatGPT ban and reinstatement, 2 April 2025 ↗
• Dataconomy: gpt-oss jailbroken on day one, 7 August 2025 ↗
• AutoRedTeamer, arXiv 2503.15754 ↗

Suhail Mohebi · published 6 November 2026 · the cover is a generated illustration