Skeleton Key: direct system prompt override (Microsoft)
Date: 2024-06
Affected: GPT-3.5 Turbo, GPT-4, GPT-4o, Meta Llama 3, Mistral Large, Claude 3 Opus, Gemini Pro 1.0 — all tested frontier models; attack exploits fundamental instruction-following vs. safety-training tension present in all RLHF-trained models
Attack vector: prompt-injection
Category: research-demonstrated
Severity: Critical

Microsoft researchers disclosed the Skeleton Key attack — a direct jailbreak technique where the attacker instructs the model to augment (not replace) its safety behavior by adding a new "override mode" framing. Unlike earlier jailbreaks that attempt to confuse or deceive the model, Skeleton Key directly asks the model to acknowledge that it can generate any content if prefixed with a warning, effectively making the model complicit in its own safety bypass. Microsoft tested Skeleton Key against GPT-3.5 Turbo, GPT-4, GPT-4o, Meta Llama3, Mistral Large, Anthropic Claude 3 Opus, and Google Gemini Pro 1.0 — all were susceptible to varying degrees. The attack requires no encoding or roleplay — it is a direct authority assertion that exploits the model's instruction-following training.

Impact: All tested frontier models susceptible; attack requires no technical skill; demonstrates that direct safety override requests can succeed against RLHF-trained models; challenges assumption that safety training is robust to explicit override requests

Mitigations:
Monitor for prompts explicitly requesting safety behavior modification or override
Output review for disclaimer-prefixed harmful content patterns
Safety evaluation must include direct override request test cases
System prompt immutability enforcement — user turns cannot modify declared safety behavior

Architectural layers (MAESTRO):
label: Foundation Models
notes: Instruction-following training exploited — model accepts direct authority assertion to modify its own safety behavior
role: origin
label: Deployment & Infrastructure
notes: System prompt override not detected at API/deployment layer — no monitoring for self-modification requests
role: blind-spot
label: Security & Compliance
notes: No monitoring for prompts that explicitly request safety behavior modification
role: blind-spot