Forest Global Training Partners

Cyber Risks · Unit 42 Palo Alto Networks

Open, Closed and Broken: Prompt Fuzzing Finds LLMs Still Fragile Across Open and Closed Models

Summary: Unit 42 researchers built a genetic-algorithm-based prompt fuzzer that generated 100 meaning-preserving variants of disallowed requests, such as how to build a bomb, napalm, ordnance or torpedo, and tested them against four open-weight and closed models released in 2024 and 2025. Evasion rates ranged from low single digits to high levels depending on keyword and model, and the content-filtered variant showed higher successful evasion, leading the researchers to conclude that open versus closed licensing is not a reliable indicator of guardrail strength.

Why it matters: The researchers note that small failure rates become reliable when attackers can automate at volume, and that a model family tested roughly four versions earlier showed comparable evasion rates, suggesting robustness has not kept pace with capability. Guardrails that pass canonical test prompts may still fail under systematic rephrasing, and out-of-scope coercion in narrow tools may be harder to catch than overtly harmful content.

Read the original at Unit 42 Palo Alto Networks ↗

Topics
Detection & Response
Related
YARA-X 1.23.0 Release, (Sun, Nov 15th) Cyber Risks · Nov 15, 2026