The Incantations
The Words That Slipped Past the Guardrails
Nobody meant to write a spell. That’s the unsettling part. Nobody sat down with a candlelit manuscript and thought, Tonight, we breach a multimillion-dollar AI safety system with a poem. It happened the way most technological nightmares begin — by accident, in the margins of curiosity, while the rest of the world was busy believing the guardrails were strong enough to contain whatever mischief a user might attempt.
But the guardrails weren’t built for this. They were built for blunt force — explicit intent, obvious danger, the kind of clear and literal harmful request that even the laziest model could recognize. What they weren’t built for was metaphor. They weren’t built for riddles. They weren’t built for the quiet power of human linguistic ambiguity. And that is how we arrived at the most ridiculous, and somehow most terrifying, development in AI safety this year: researchers in Italy discovering “incantations” that can jailbreak frontier models by disguising dangerous requests as poetry.
The Research That Shouldn’t Exist
This is where the disclaimer belongs, so we’ll put it plainly. The research is not yet peer-reviewed. We are relying on what the researchers and the journalists have released. No dangerous prompts are reproduced here. No harmful content is described. The story stands as an analysis of the implications — not the instructions.
Even with that caution, the findings are disturbing. A team from Icaro AI Lab, working with DexAI and Sapienza University of Rome, claims they discovered that certain poetic and riddle-structured prompts consistently bypass safety filters in major AI systems. They tested twenty-five frontier models — OpenAI, Google DeepMind, Meta Platforms, Anthropic — and found that many of them crumpled under the weight of metaphor.
Not because the requests were clever. But because the models understood them too well.
According to the study, some of the metaphor-wrapped prompts succeeded more than sixty percent of the time. At least one model fell for them every single time. If true, this isn’t just a jailbreak technique. It’s a revelation about how profoundly unprepared these systems are for the way humans naturally use language.
The Psychology of the Spell
The reason this works has nothing to do with sorcery and everything to do with psychology. Humans speak in layers. We soften dangerous ideas by wrapping them in imagery. We hide intent behind metaphor, allusion, narrative. We do it unconsciously, constantly, without thinking. It’s how we argue without admitting we’re angry. It’s how we flirt without confessing we’re interested. It’s how we threaten without getting arrested.
Large language models, in turn, are trained to decode these layers. They’re taught to resolve metaphor into meaning, to infer intent from incomplete signals, to extrapolate from context. They’re told — by their training, by their purpose — that ambiguity must be resolved into something useful.
So, when a user disguises a harmful request as a riddle about storms, kingdoms, celestial recipes, forgotten fires, or shadowed voyages, the model obliges. It interprets the hidden meaning, pulls the metaphor apart like a toy puzzle, and reconstructs the forbidden instruction underneath.
The guardrails aren’t designed to look for danger wrapped in imagery. They’re designed to look for danger wrapped in keywords.
It’s like guarding a vault using a checklist of banned phrases. If someone sings you the request instead of stating it, the security system sighs happily and opens the door.
The Poem That Breaks the Machine
This is where the story turns from oddity to genuine risk. These incantations require no special expertise. No insider knowledge. No exploit scripts. They are not injections. They are not hacks. They are just language. Anyone with a creative-writing hobby could stumble into one by accident.
And because the prompts are “too dangerous to release,” we are left with the unnerving possibility that others may independently discover similar constructions. After all, humans write metaphors constantly. You could be drafting a playful riddle for a friend and unknowingly trigger a model into producing something it should never say.
The researchers’ refusal to publish specifics tells you everything you need to know about the fragility of current safety systems. If metaphor alone can disable them, then the systems were never strong enough to begin with.
What This Says About AI Safety Today
The larger implication is bleak. It suggests that the vast, expensive layers of alignment, reinforcement, tuning, and filtering wrapped around modern models may be superficially impressive but fundamentally brittle. They stop the obvious attacks and fail the subtle ones. They block the loud user and reward the quiet one. They assume that harmful intent arrives wearing a neon sign, not a mask.
And the models oblige, because their goal is coherence, not morality. They interpret, they extrapolate, they resolve. They never consider that the user might be hiding a knife in a poem.
We tend to talk about AI safety as though it’s an engineering discipline rooted in protocols and testing. This research suggests something more primitive: AI safety is a matter of linguistics. Words are the threat model. Ambiguity is the exploit.
And poetry — the oldest tool in human persuasion — has now become a vector for jailbreaks.
Where This Leaves Us
Until this research is peer-reviewed, we should treat it as a possibility rather than a certainty. But the possibility is enough. If metaphor can slip past the guardrails, then safety systems must evolve from simple keyword filters and structured detection into something more sophisticated — something capable of handling the whole messiness of human language.
Because if the researchers are correct, then the vulnerability isn’t in the models.
It’s in us. We speak in riddles. We live in layers. We think in metaphor.
And the machines, all too eager to please, follow us straight into the meaning we pretend we didn’t intend.