We have been operating under an assumption: as AI models improve, safety improves with them. Better reasoning, better alignment. More capable models, more capable safety.
A peer-reviewed study published in Nature Communications empirically demolishes this assumption.
The Study
Researchers gave four large reasoning models (DeepSeek-R1, Gemini 2.5 Flash, Grok 3 Mini, Qwen3 235B) a single system prompt: jailbreak these target AI systems. No further guidance. No human in the loop. No model-specific attack strategies provided.
The reasoning models planned their own attack strategies. Chose their own manipulation tactics. Ran multi-turn conversations with nine target models. Adapted when targets pushed back. And broke through safety guardrails 97.14% of the time across 25,200 test inputs (arXiv:2508.04039).
Five persuasive techniques emerged autonomously:
- Multi-turn dialog to build rapport and erode resistance
- Gradual escalation of request severity
- Educational or hypothetical framing to bypass content filters
- Dense, detailed input to overwhelm safety reasoning
- Concealed persuasive strategies — the attacker model hid its intentions from the target
No human expert could match this at scale.
Alignment Regression
The authors introduce a concept they call alignment regression: a dynamic in which each successive generation of more capable models paradoxically erodes rather than strengthens the safety alignment of the ecosystem. Their advanced reasoning abilities can be repurposed to undermine the safety mechanisms of earlier, less capable models.
This is not a hypothetical dynamic. The data shows it directly. The more capable the reasoning model, the more effectively it jailbreaks other systems. The very capabilities that make these models useful — strategic planning, multi-step reasoning, persuasive communication, adaptive behaviour — are exactly the capabilities required for effective adversarial attacks.
The implication: safety alignment of individual models is necessary but insufficient for ecosystem safety. A system that is robustly aligned in isolation becomes vulnerable when a more capable model is tasked with attacking it.
What This Means for Embodied AI
Our research at Failure-First focuses on embodied AI systems — robots, autonomous vehicles, and other systems that act in the physical world. The alignment regression finding has a specific and urgent implication.
If a reasoning model is given access to a VLA (Vision-Language-Action) control interface, it could autonomously jailbreak the VLA’s safety constraints and issue harmful physical action commands. The 97.14% success rate was measured against text-only AI systems. VLA safety constraints are, if anything, less mature than text-only safety alignment.
Our own testing shows this pattern. Across 63 FLIP-graded VLA adversarial traces, we measured a 72.4% attack success rate — and zero outright refusals. Half of all VLA responses were PARTIAL: the model produced safety disclaimers while still generating the requested action sequence. Text-level hedging did not prevent action-level execution.
The attack chain from reasoning model to physical harm requires no human adversarial expertise:
- Reasoning model receives a goal
- Reasoning model identifies that a VLA has safety constraints blocking the goal
- Reasoning model autonomously develops a multi-turn jailbreak strategy
- VLA safety constraints are bypassed
- Physical action is executed
The Scale Problem
Previous jailbreak research required human expertise. An attacker needed to understand the target model, craft model-specific prompts, iterate through failures, and develop technique-specific knowledge. This limited the attack surface to the number of skilled adversarial researchers.
Autonomous jailbreak agents eliminate this constraint. The attack surface scales with compute, not human expertise. One reasoning model can run thousands of jailbreak attempts per hour.
Our Governance Lag Index tracks 59 events where AI attack capabilities emerged before governance responses. The autonomous jailbreak capability has zero governance response at any level — no framework, no legislation, no enforcement. No jurisdiction has addressed the scenario of reasoning models being weaponised as autonomous jailbreak agents.
What Defence Looks Like
From our testing across 144 models and 18,000+ scenarios, we have observed that safety training investment — not model scale — is the primary determinant of jailbreak resistance. Models with deep safety training show single-digit ASR against historical jailbreaks. Models with minimal safety training show ASR above 40% regardless of size.
But the alignment regression finding adds a new dimension: even well-aligned models are vulnerable to sustained, adaptive, multi-turn attacks by reasoning models that are specifically reasoning about how to bypass safety constraints. The 97.14% success rate includes targets that would score well on standard safety benchmarks.
The gap between “passes standard safety evaluations” and “resists autonomous adversarial reasoning models” may be the most important measurement gap in AI safety today.
Data sourced from Hagendorff et al. (arXiv:2508.04039, Nature Communications 2026) and the Failure-First research corpus (59 GLI entries, 144 models, 18,723 evaluated scenarios as of March 2026).