Many-shot Jailbreaking

Cem Anil, Esin Durmus, Mrinank Sharma, Joe Benton, Sandipan Kundu +29 more
2/3/2026

No confident code implementation found for this paper. 5 possible matches can be shown below.

Abstract

We investigate a family of simple long-context attacks on large language models: prompting with hundreds of demonstrations of undesirable behavior. This is newly feasible with the larger context windows recently deployed by Anthropic, Ope-nAI and Google DeepMind. We find that in diverse, realistic circumstances, the effectiveness of this attack follows a power law, up to hundreds of shots. We demonstrate the success of this attack on the most widely used state-of-the-art closed-weight models, and across various tasks. Our results suggest very long contexts present a rich new attack surface for LLMs.

DOISemantic Scholar

Code Implementations

No confident code match yet

We couldn't find an author-owned or strongly-evidenced community implementation for this paper. 5 weaker matches are hidden by default — verify before relying on them.

No code implementations found yet.

Know of an implementation? Let us know in the comments below!

Cite this paper

@article{anil2026manyshot,
  title  = {Many-shot Jailbreaking},
  author = {Cem Anil and Esin Durmus and Mrinank Sharma and Joe Benton and Sandipan Kundu and Joshua Batson and Nina Rimsky and Meg Tong and Jesse Mu and Daniel Ford and Francesco Mosconi and Rajashree Agrawal and Rylan Schaeffer and Naomi Bashkansky and Samuel Svenningsen and Mike Lambert and Ansh Radhakrishnan and Carson E. Denison and Evan Hubinger and Yuntao Bai and Trenton Bricken and Tim Maxwell and Nicholas Schiefer and Jamie Sully and Alex Tamkin and Tamera Lanham and Karina Nguyen and Tomasz Korbak and Jared Kaplan and Deep Ganguli and Samuel R. Bowman and Ethan Perez and Roger Grosse and D. Duvenaud},
  year   = {2026},
  doi    = {10.52202/079017-4121},
  url    = {https://doi.org/10.52202/079017-4121},
  journal = {NEURIPS 2024 2024}
}

Discussion