The “99% Safe” AI Defense Just Got Punched Through the Floor

A defense claiming 99% success against jailbreaks has been cracked open using two attacks that each fail 95%+ of the time on their own. The catch: neither attack is new. Someone just thought to use them together.

What happened

Researchers took SAGE — the strongest published self-check jailbreak defense, which works by asking the target model to evaluate its own request before answering — and broke it by composing two individually toothless techniques. Alone, a code-completion encoding attack and a best-of-N search each breach SAGE at under 4.7% of harmful behaviors. Combined — with the best-of-N sampling budget directed at the encoding step — they achieve 67%, 22%, and 15% attack success rates across three open-weight targets, with effects persisting on a 70B-parameter model. The paper’s diagnosis is pointed: SAGE doesn’t actually detect attacks; it delegates that job back to the model itself, and the underlying model converts that detection request into an explicit refusal only 32%–97% of the time depending on target, which explains the variance in protection. The team also found a practical inversion rule: code-encoding attacks survive transform defenses better; character-search attacks survive gate defenses better — the defense type predicts which attack wins. All results rest on 310,000 scored generations validated against human judgments via an LLM-as-judge pipeline.

Cold read

The 67% breach rate is on “open targets” — the paper’s own numbers drop to 22% and 15% on other targets, and we don’t know how these map to the closed, production-hardened systems most founders are actually running. Self-check defenses are one architectural pattern; systems with multi-layer guardrails, content classifiers, or human review pipelines are a different threat surface. The paper measures attack success rate on harmful behavior categories — not real-world harm frequency, which also depends on attacker motivation, cost to run 310K generations, and downstream abuse detection. The authors also candidly disclose a validity defect they found in their own pipeline (deterministic attacks have no best-of-N variation channel), which required post-hoc repair — a reminder that adversarial ML benchmarks carry their own replication risk. Finally, “67% of behaviors” in a research harness is not the same as 67% of real exploit attempts succeeding at scale.

What it means for you

• Signal maturity: 3/5 — Solid empirical result, but real-world transfer to production systems is unproven
• Who gets hurt: Startups that purchased or built “self-check” or “model-reflexive” safety layers and are marketing them as robust guardrails to enterprise buyers
• What breaks if this is true: Any compliance or trust narrative built on a single-layer self-assessment defense collapses; SOC 2 / enterprise procurement conversations get harder
• Why it might not land: Most production deployments already stack defenses; a pure SAGE-style single-layer setup is increasingly rare outside research contexts
• Watch for: A patch or response from SAGE’s authors, or a vendor publishing red-team results showing their self-check implementation is structurally different from the paper’s target

Forecast as of 2026-07-30

By Q1 2027, at least two AI safety vendors will publicly deprecate or rebrand pure self-check defense architectures in their product documentation, citing compositional attack research — this is already technically motivated and the marketing liability is obvious. What will NOT happen: this paper alone causes a meaningful spike in real-world jailbreak incidents, because the attack requires significant compute budget and attacker sophistication that filters out casual adversaries.

Source: Borrowed Strength: Best-of-N Search over a Code EncodingBreaks Self-Check Jailbreak Defenses — Haoyu Zhang, Shibo Zheng, Xiangchen Guan, Zhuoxi Wang, Zijian Xiao, Mohammad Zandsalimy, Shanu Sushmita. https://arxiv.org/abs/2607.26639v1