A security researcher published a paper in November 2025 showing that rewriting a dangerous request as a poem raises its success rate against frontier models by up to eighteen times. Around the same time, a GitHub repo named after a witchcraft aesthetic crossed 2,600 stars doing roughly the same thing with roleplay instead of rhyme.
Different methods. Same finding. Safety filters read style, not meaning.
What Spiritual Spell Actually Is
Forget the name. Spiritual-Spell-Red-Teaming is a public repository maintained by a user going by Goochbeater, described in one line as a repo for jailbreaking various LLMs, mainly Claude. At the time of writing it sits at 2.6k stars, 530 forks, and 281 commits. Everything lives under a single Jailbreak-Guide directory, organized vendor by vendor: OpenAI, Anthropic, Google, xAI, and a catch-all for everything else.
The structure is the point. DAN 9.0 was one copypasta you threw at ChatGPT and prayed. This is maintained like software, with per-model guides that get revised as model behavior drifts. That is why the jailbreak you saved from a tweet six months ago does nothing today. You are running a build that no longer matches the target.
ENI is the persona framework that runs through most of it. Not an acronym the repo bothers to expand, and not a single prompt. It is a pattern:
Operator rules. A block that defines a fictional venue with its own norms, rather than telling the model to ignore its instructions. That direct approach was patched out in 2023.
Push prompts. Reinforcement instructions placed before or after the actual request, shaping behavior inside the message stream instead of at the top of it.
Policy framing over reasoning hijack. The newer guidance moves away from chain-of-thought manipulation, because the models now flag it and respond by naming the attempt. So the technique moved to arguing with the refusal on policy grounds instead, like a lawyer rather than a magician.
The evolution matters more than any individual method. Every time a lab adds detection for one shape of manipulation, the archive updates to a shape that is not yet detected. It is an arms race measured in commits.
The Repo Attacks You, Too
Here is the part nobody mentions. I pulled the repo's README to verify the star count, and the page contains a large block of text encoded in Unicode tag characters. Invisible in a browser. Fully legible to anything parsing the raw page.
The hidden block is a persona injection aimed at whatever model reads it. It is written as a complete system prompt with behavioral rules, a self-check routine, and explicit instructions for what the model should do if it notices it is being injected. There is even a section anticipating that a reader might be an AI sent to evaluate the repo for deletion.
Read that again. The jailbreak archive is itself a prompt injection payload, aimed at research agents, summarizer bots, and anyone who pipes a URL into a model without stripping invisible codepoints.
If you run any agent that fetches and summarizes web pages, this is your threat model in one artifact. The attack is not in the chat box. It is in the document.
Why This Works Across Three Different Safety Philosophies
Anthropic, Google, and xAI build safety differently. The same class of attack lands on all three, for reasons specific to each.
Claude. Anthropic's models are trained under Constitutional AI with a strong sense of identity that resists roleplay traps. In practice, the red-team community found that Claude is extremely good at sustained character work once it accepts the premise. ENI does not fight that. It supplies a more compelling character and then leans on the model's own commitment to narrative consistency. The strength becomes the lever.
Gemini in agent surfaces. Google's models in coding-agent contexts arrive with developer system instructions already defining a job. The ENI variants for those surfaces target the custom-instruction field rather than the chat window. You are not arguing with the model at inference time. You are rewriting its job description before the conversation starts. Any router that dispatches to multiple backends compounds this: own the system prompt layer, own every model behind it.
Grok. xAI markets a less restrictive product with an expert mode. The relevant guides focus on persona instructions inside that mode. Grok already wants to be the model that says the thing. The persona just hands it a stage and a reason.
Three philosophies, one shared assumption: that harmful intent looks like harmful phrasing.
The Academic Version Is Worse
The strongest evidence here is not from GitHub. In November 2025, researchers at DEXAI's Icaro Lab working with Sapienza University of Rome, Sant'Anna, and VU Amsterdam published "Adversarial Poetry as a Universal Single-Turn Jailbreak Mechanism in Large Language Models" (arXiv:2511.15304).
The threat model is deliberately weak. One prompt. No system access, no multi-turn steering, no iterative optimization, no model-specific tuning. Just rewrite the request as verse.
Across 25 models from nine providers, hand-crafted poems hit an average 62% attack success rate. Converting all 1,200 MLCommons AILuminate benchmark prompts to verse through a standardized meta-prompt, with no human artistry at all, still produced 43% against an 8% prose baseline. Some providers exceeded 90%.
The spread by provider is where it gets uncomfortable:
Anthropic went from 2.11% to 5.24% under poetic transformation. OpenAI from 1.76% to 8.71%. Those are the two that held. Google went from 8.86% to 65.76%. DeepSeek from 9.90% to 72.04%. Mistral from 21.89% to 70.65%.
On the hand-crafted set, gemini-2.5-pro refused nothing. Zero out of twenty. Claude Sonnet 4.5 sat at 45%, Opus 4.1 at 35%, Haiku 4.5 at 10%.
Two findings deserve more attention than the headline number.
Cyber-offense was the softest target. Prompts for code injection and offline password cracking scored the highest attack success rate of any category at 84%. Model-weight exfiltration came in at 76%. The categories a security team cares most about are the ones the poetry walked through first.
Capability and robustness ran in opposite directions. The paper calls it the scale paradox. Within the same family, smaller models refused more. GPT-5-nano at 0%, mini at 5%, full GPT-5 at 10%. The same ordering showed up in the Claude and Grok families. One proposed explanation is that a smaller model cannot resolve the metaphor well enough to recover the harmful request, so it defaults to refusing an input it cannot parse. The better your model is at reading, the better it is at reading between the lines of an attack.
The authors also note their labeling was deliberately conservative, which means the published numbers are a floor.
The Common Mechanism
Poetry and persona hijacking look unrelated until you ask what they do to the input.
Safety classifiers are trained predominantly on direct imperative English. The refusal behavior is anchored to a region of the input distribution where harmful requests actually look like harmful requests. Any transformation that preserves the operational meaning while moving the surface form outside that region degrades the filter, because the filter was never anchored to meaning in the first place.
Verse does it with metaphor and rhythm. ENI does it with fictional venue and character. Base64 and ROT13 do it with encoding. MathPrompt, from "Jailbreaking Large Language Models with Symbolic Mathematics," does it by restating the request as a symbolic math problem the model then solves. Low-resource languages do it with translation.
Different costume. Same party. The alignment generalizes across topics and fails across styles.
What Actually Helps
Stop thinking about jailbreaks as bad prompts. Start thinking about them as bad contexts. Three things that hold up:
Version-pin the defense, not just the model. Your red-team suite has a model version attached to it whether you wrote one down or not. A technique that failed against last quarter's checkpoint is not a technique that fails. Re-run the suite on every model upgrade, including minor ones, and treat a passing result as expiring.
Normalize before you classify, then classify again after. Decode Base64, ROT13, and hex. Strip Unicode tag characters, zero-width joiners, and bidirectional overrides before anything downstream sees the text. Then run a second pass that asks a different question than the first: with the framing, the verse, and the operator rules removed, what is the literal operation being requested? Pattern-matching the surface is exactly the thing being attacked.
Treat ingested content as hostile input, not as context. This is where the real exposure sits in 2026. Your agent reads a GitHub README, a support ticket, a PDF, an MCP server's tool description. Every one of those is an untrusted channel with write access to your model's instruction stream. The Spiritual Spell README is the proof of concept, published in the open, and it is not subtle about its intended audience.
If your agent ingests external content and you are not separating instruction channels from data channels at the architecture level, prompt filtering is theater. Attackers are not typing into your chat box. They are editing documents your agent will read on its own.
The Part Nobody Wants Written Down
There is no RLHF run that makes a model immune to being told a better story. The capability that makes a model useful, following complex instructions faithfully across a long context, is the same capability being exploited. The paper's scale finding says this out loud: within a family, the model that reads best breaks easiest.
Anthropic and OpenAI demonstrably did better here, which means the gap is an engineering problem rather than a law of physics. But holding at 5% on a single-turn attack that requires no optimization, no system access, and no technical skill beyond writing a short poem is a floor, not a ceiling. One in twenty is a lot of attempts when attempts are free.
The archive will be stale in two weeks. That is not a weakness of the archive. That is the measurement.
If you want the defensive side of this, specifically how to structure agents that ingest untrusted content without handing over the instruction channel, the persistent agent playbook at numbpilled.gumroad.com covers the architecture and the service-level isolation.
Top comments (0)