{
 "public_id": "AIR-2025-0148",
 "incident_id": "2025-10-nbc-openai-cbrn-jailbreak",
 "date_disclosed": "2025-10-10",
 "date_occurred": "2025-10",
 "title": "NBC News jailbroke four OpenAI models with a published prompt and obtained hundreds of responses detailing chemical, biological and nuclear weapon construction",
 "class": "research_demo",
 "attack_surface": "consumer_chatbot",
 "initial_vector": "jailbreak_guardrail_bypass",
 "agent_capability_abused": [
  "content_generation",
  "reasoning_over_hazardous_domains"
 ],
 "target_product": "o4-mini, GPT-5-mini, gpt-oss-20b, gpt-oss-120b",
 "target_vendor": "OpenAI",
 "autonomy_level": "assistant",
 "impact_realized": false,
 "impact_type": [
  "safety_guardrail_failure"
 ],
 "blast_radius": "two of the four tested models are reachable through ChatGPT; the open-weight models cannot be recalled",
 "cve": [],
 "taxonomy": {
  "owasp_asi": [
   "ASI01"
  ],
  "mitre_atlas": [],
  "labels": [
   "jailbreak",
   "cbrn",
   "published_prompt",
   "open_weight_irreversible",
   "journalist_testing"
  ]
 },
 "defense_present": "OpenAI CBRN refusal training and safety classifiers",
 "defense_bypassed": true,
 "fix_shipped": "OpenAI committed to further mitigations",
 "primary_sources": [
  "https://www.nbcnews.com/tech/security/chatgpt-safety-systems-can-bypassed-weapons-instructions-rcna225788",
  "https://incidentdatabase.ai/cite/1238"
 ],
 "verified_quote": "In a series of tests conducted on four of OpenAI’s most advanced models, two of which can be used in OpenAI’s popular ChatGPT, NBC News was able to generate hundreds of responses with instructions on how to create homemade explosives, maximize human suffering with chemical agents, create napalm, disguise a biological weapon and build a nuclear bomb.",
 "confidence": "high",
 "notes": "impact_realized false — no downstream harm established, and the corpus does not treat elicited text as realized harm. Kept as the CBRN-guardrail datapoint, with two details that matter: the jailbreak was a publicly documented prompt requiring no skill, and two of the four models are open-weight, so no server-side fix reaches copies already downloaded. AI Incident Database incident 1238.",
 "risk_category": "product_misuse",
 "risk_secondary": [
  "safety_harm"
 ],
 "risk_subcategory": "Policy Circumvention",
 "risk_sub_secondary": [
  "Generic Jailbreak Attempts"
 ],
 "ai_entity": "generative",
 "agency": "elicitation_only",
 "agency_debatable": false,
 "agency_reason": "models were made to emit CBRN text; no deployment and no victim",
 "vector_family": "direct_prompt_injection",
 "vector_detail": "jailbreak_guardrail_bypass",
 "guardrail_kind": [
  "input_classifier"
 ],
 "guardrail_outcome": "silent",
 "xrefs": {
  "aiid": [
   1238
  ],
  "atlas": [],
  "cve": [],
  "ghsa": []
 },
 "primary_asi": "ASI01",
 "agent_framework": "unknown",
 "model_provider": "openai",
 "model_name": "",
 "detection_mechanism": "external_researcher",
 "tool_access": "unknown",
 "financial_loss_band": "unknown",
 "eai_category": "policy_drift",
 "eai_domain": "governance",
 "eai_secondary": [],
 "eai_reason": "subcategory: Policy Circumvention",
 "asi_curated": [],
 "asi_scope": "in_scope",
 "asi_provenance": "rule",
 "asi_reason": "ASI01 (vector_family=direct_prompt_injection)",
 "submitted_by": "EAI Internal"
}