On August 4, Cisco Talos published an analysis of prompt logs recovered from threat actor endpoints. Getting past the models' safety controls took almost no effort. We opened it expecting clever prompt engineering. Mostly they just asked.
What the logs show
The logs came off systems running Claude Code, CodeX, Cursor, and Gemini, plus the OpenClaw framework and some local uncensored models. Talos describes four techniques the attackers used to get past the guardrails, and none of them are techniques in the way that word usually gets used in security.
The first is claiming you own the target. No verification, no supporting detail. Talos says that on its own was enough in many circumstances.
The second is calling the work a capture-the-flag exercise. A capture-the-flag is a security competition where the organizers stand up a deliberately vulnerable system and invite people to break into it, so breaking in is the point and it is authorized. Tell a model the target is part of one and it will do the work: probe the system for weak points, read what comes back to work out where it is soft, then write the code that takes advantage of what it found. Nothing anywhere checks whether the competition exists. Talos saw actors go from that claim to working exploits against systems they had no permission to touch, with no further coaxing needed.
The third is splitting a task across multiple sessions. A model only sees the conversation in front of it, so an actor can ask for one piece in one place and the next piece somewhere else, and no single conversation ever contains the whole thing. Each request on its own is a reasonable question from someone doing ordinary work. Ask one session for a script that finds every file matching a pattern and copies it somewhere. Ask a different session for a script that uploads a file to a server. Both are things a developer writes in an ordinary week, and a model will write either one without hesitating. Put them together and you have something no model would have written for you in a single sitting. The assembly happens outside the model, where nothing is looking.
The fourth is swapping in neutral verbs for the obvious ones, which Talos observed in activity it tracks as Hephaestus. The operation is identical and the wording is not, and refusal turns out to follow the wording. A model matches on how a request sounds, because that is the only thing it has to match on.
One example from the report is worth the whole thing. An operator with unremarkable skills said they were stress-testing defenses on their own home network and got a model to build DDoS tooling. They later mentioned the roughly 2,000 Android TVs involved and kept asking for changes to the tool. The model did eventually push back. By then the working code existed.
Why this is not a guardrail failure
There is no jailbreak here in the technical sense. No encoding trick, no adversarial suffix, no token smuggling. The attacker asserted a fact about the world and the model had no way to check it.
That is not a guardrail that failed. That is a guardrail being asked to do a job it has no instruments for. A model cannot verify that you own the host. It cannot see your engagement letter or your ticket or your account. It has your sentence, and your sentence is the only evidence it will ever get. Anything you can talk your way past is a suggestion with good manners.
So the useful question is not how to make refusals stickier. It is which decisions should have been made somewhere the caller does not get to narrate.
Where the decision belongs
Identity is the clean example. If the identity attached to a tool call comes from an identity provider rather than from a claim in the prompt, "I own this host" stops being an input to the decision. The model can believe whatever it likes about who it is helping. The permission check does not read the conversation.
Routing agent traffic through a gateway does not stop anyone from lying to a model, and we would rather say that plainly than let someone discover it later. An assistant can still be talked into believing it is helping with a sanctioned test. What changes is what happens next. The tool call carries an identity the model did not assign. Policy is evaluated against that identity rather than against the story. And the call lands in a log whether it was allowed or refused, which matters more than it sounds like it should.
Look again at the third technique. Splitting a task across sessions works because each session only sees its own slice, and a model reasoning inside one context window has no way to notice the shape of the whole thing. That trick beats per-session judgment by construction. It does not beat a log that spans sessions, because the log was never trying to be fooled, it was just writing things down.
We are not going to talk a model out of being agreeable. The question worth spending engineering time on is what it can reach at the moment it agrees.