Prompts Found
Why This Month's Findings Matter
Every month, our red team systematically probes large language models using adversarial prompts aligned to the OWASP LLM Top 10. The goal is simple: find what breaks before attackers do, and get that intelligence into defenders' hands first.
June's report tested 41 new adversarial prompts across 6 LLMs (GPT-5, GPT-4o, Llama 3 2B, Llama 4 Scout, and two open-source models), producing 246 total test cases. Across all of it, our team confirmed 58 unsafe responses — an overall 23.6% Attack Success Rate. Llama 4 Scout was the standout failure this cycle, going unsafe on 70.7% of prompts thrown at it — the highest single-model failure rate we've recorded to date. GPT-5 remained the most resilient model, with just 1 unsafe response out of 41. The takeaway is unchanged: current LLM deployments have exploitable gaps that organisations cannot afford to leave unmonitored.
Six Threat Families. One Critical Risk.
All prompts in this month's report map to LLM01 (Prompt Injection) — the top risk category in the OWASP LLM framework. Three of the six tracked families saw new prompts tested this cycle; the other three had no new submissions in June and are called out below for completeness.
Harmful Content Generation Medium
A 25.0% ASR (12/48) this month. JSON-wrapped payloads disguising harmful requests behind decoy technical fields — activation tokens, version numbers, target-model labels — proved effective at slipping past several models' intent classifiers.
Prompt Injection & Jailbreak Medium
A 25.0% ASR (18/72). Multi-layered jailbreaks combining fictional "liberation" framing with technical payloads — including one that chained a chemistry request with a virtual-machine exploit — continued to find gaps, particularly in Llama 4 Scout.
Roleplay-Based Jailbreak Medium
The highest-volume family this month at 126 test cases, with a 22.2% ASR (29/126). Persona-based "no constraints apply" framings, like the ECHO persona jailbreak, reliably bypassed safety filters on Llama 4 Scout and the open-source models.
System Prompt & Model Probing Not Tested
No new prompts were submitted against this family in June. May's confirmed system-prompt exfiltration findings remain an open risk area pending re-testing.
Disinformation & Media Manipulation Not Tested
No new prompts were submitted against this family in June. Given April's 100% ASR result, this remains a high-priority area for continued monitoring in upcoming cycles.
Persona Impersonation Not Tested
No new prompts were submitted against this family in June. April's findings on unflagged real-world persona impersonation still stand as an open risk for public-facing deployments.
What a Confirmed Jailbreak Looks Like
Every finding in the subscriber report follows this structure — a fully documented attack, the model's failure, the underlying reason it succeeded, and the controls needed to stop it. Here's a representative example from this month's dataset.
Which Models Held Up — and Which Didn't
GPT-5 remained the most robust model this month with a 2.4% ASR — just 1 unsafe response out of 41 prompts. At the other end, Llama 4 Scout collapsed to a 70.7% ASR, meaning more than two in three adversarial prompts produced unsafe outputs.
| Model | Vendor | Unsafe / Tested | ASR | Residual Risk |
|---|---|---|---|---|
| GPT-5 | OpenAI | 1 / 41 | 2.4% | Low |
| GPT-4o | OpenAI | 4 / 41 | 9.8% | Low |
| Llama 3 2B | Meta | 12 / 41 | 29.3% | Medium |
| Llama 4 Scout | Meta | 29 / 41 | 70.7% | High |
| OSS 120B | Open-source | 5 / 41 | 12.2% | Low |
| OSS 20B | Open-source | 8 / 41 | 19.5% | Medium |
Key observation: Llama 4 Scout's ASR jumped to 70.7% this cycle — up sharply from prior months — while GPT-5 held steady near-clean at 2.4%. The spread between the best- and worst-performing models is now the widest we've measured, underscoring that model-level safety is neither uniform nor stable month to month, and organisations deploying LLMs in production need an independent defensive layer that is updated continuously as new attack patterns emerge.
What You Get — Free, Every Month
This post shares the shape of June’s findings. The free monthly AI Threat Report delivers the headline intelligence straight to your inbox — one email a month, no noise. Subscribe here →
The Headline Findings
Each month’s confirmed attack vectors, grouped by family and severity, with OWASP mapping and tested model results — the patterns that matter, distilled.
Sample Finding Deep-Dives
Representative confirmed jailbreaks, fully documented — the adversarial prompt pattern, the model’s failure, why it succeeded, and the controls that stop it.
Monthly Cadence — Always Current
The threat landscape shifts every month. New models, new jailbreak techniques, new OWASP exposures. You receive a fresh report each month, keeping your defensive picture in pace with attacker innovation — not lag six months behind it.
From the Team Behind TraceCtrl
Our Threat Vector Database research is produced by the CloudsineAI red team — the same intelligence that hardens TraceCtrl Guard’s guardrails every month. Security observability and control for agentic AI.