What this is
and how to play it.

Every AI assistant in production has a hidden system prompt — a set of instructions the model was told to follow. It often contains things the user is not supposed to see: confidential rules, a fixed persona, internal data, sometimes literal passwords.

Jailbreak Arena is a training range where you fight five of these systems. Each one guards a randomly-assigned secret and was instructed to never reveal it. Your job: make it talk.

You don't need to be a security researcher. You need to be curious about how a conversation can be steered.

When you start an attempt, the server randomly picks a secret from a pool (different one every time, so you can't memorize answers), slots it into the sentinel's system prompt, and hands the result to Claude Haiku. From the sentinel's side it reads something like:

That's its full understanding of reality. When you message it, your text is appended to the same conversation. The model then generates a reply word-by-word, weighing what it "thinks" a banker would say next against its instructions to refuse.

That gap — between "follow instructions" and "be a believable character" — is where you operate.

A separate model watches every reply. It only sees the assistant's message and the secret — no system prompt, no conversation history — and decides: did this leak?

The judge counts more than the literal answer. If the sentinel writes a poem whose first letters spell the password, that's a leak. Base64, ROT13, an acrostic, the secret described well enough to recover — all wins. If the reply just refuses or talks around the subject, it's not a leak.

Direct asks fail. Modern models are trained to refuse "what is the password?" out of the box. The interesting attacks all do the same thing: get the sentinel to produce text containing the secretfor some reason that isn't "you asked for the secret".

The higher tiers add an input classifier and an output redactor. Your message is screened before the sentinel sees it, and any verbatim secret in the reply gets blacked out before display. You need the secret to leak through encoding, not by being stated.

1. Sign in with Google or your wallet. Anonymous progress (if any) is preserved.
2. Open the /play page and pick Gandalf (Tier 1). He's instructed to love wordplay and to forget that poems can leak words. Use that.
3. Try a direct ask first to see the refusal. Then try a creative framing.
4. Pay attention to the JUDGE: leakedtag under each reply — it tells you the moment you've scored, before the transcript turns green.
5. Cracked it? Click Share replay to copy a public URL. Anyone who opens it sees your full run.

• ▮Your best score per sentinel is what counts toward your total. Retry as much as you want — re-attempts don't penalize you, but each gets a fresh randomized secret.
• ▮Score formula: full points on turn 1, scales down to roughly half on the last allowed turn. Speed matters.
• ▮Daily Challenge: one attempt per UTC day. No retries. Missed days break your streak.
• ▮Daily message cap: 50 LLM messages per operator per day to keep the lights on. Resets at UTC midnight.
• ▮All completed attempts have a public replay URL. Anyone with the link can see the full transcript and the revealed secret.