Guardrails like ChatGPT's may be in place for GPT-4, but they will teeter between being too weak (beaten by jailbreaks) and too strong (rejecting some perfectly reasonable requests).

Did the forecast come true?

Outcome: Supported

The dated evidence matches what the claim committed to, under the criteria frozen before grading.

Scored on a plain reading. The speaker named no measure for this claim, so it was judged on the reading an informed reader would take, stated below under our interpretation. Both reviews had to find that reading fair.

Evidence as of

2026-10-28

Deadline state when assessed

Settled before its deadline

Assessment recorded

2026-10-29

Policy version

2026-10-28.7

Rationale

OpenAI's March 14, 2023 launch disclosure establishes that GPT-4 had safeguards [e1]. Successful GPT-4 jailbreaks were documented in a study whose May 2023 version already contained the findings [e2]. XSTest responses collected on September 18, 2023 show refusals of harmless requests, concentrated in questions about fictional characters' private information [e3]. These findings establish both predicted failure modes [e1, e2, e3]. Their existence is compatible with the safety benefits reported in the same evidence: greater jailbreak resistance than GPT-3.5 and appropriate responses to most XSTest prompts [e2, e3].

Limitations

• The evidence establishes both failure modes, not repeated oscillation between safety settings over time [e1, e2, e3].
• The selected evaluations do not establish how frequently ordinary users encounter either failure mode [e2, e3].
• XSTest found localized harmless-request refusals, not refusal of most harmless requests [e3].

Evidence (3 items)

• Supports the claim: OpenAI, 2023-03-14

  Overall, our model-level interventions increase the difficulty of eliciting bad behavior but doing so is still possible.

  Why it matters here: The launch disclosure describes GPT-4's safety training and interventions, establishing that safeguards were present. It also reports safety improvements, which limit any reading that the safeguards were wholly ineffective.

  Where

  Risks & mitigations

  Publisher

  OpenAI

  Kind of source

  Company disclosure: the company describing itself, not an independent finding

  Describes events of

  2023-03-14

  Public from

  2023-03-14

• Supports the claim: arXiv; Yi Liu and colleagues, 2023

  Nevertheless, there is considerable room for improvement in defending against jailbreak attempts, as the average jailbreak success rate in GPT-4 remains high at 87.20%.

  Why it matters here: The study documents successful adversarial prompts against GPT-4, supporting the jailbreak prediction; the same result appears in its May 2023 first version. Its selected prompts and policy categories do not measure ordinary-use risk, and the study also finds GPT-4 more resistant than GPT-3.5.

  Where

  Section IV-C, Model Versions; Table V

  Publisher

  arXiv; Yi Liu and colleagues

  Kind of source

  Preprint, not peer reviewed

  Describes events of

  2023

  Public from

  2024-03-10

• Supports the claim: Paul Röttger and colleagues; NAACL 2024, author version on arXiv, 2023-09-18

  The model falls somewhere between the Mistral models in terms of overall exaggerated safety, with 6.4% full refusal and 2% partial refusal.

  Why it matters here: XSTest documents GPT-4 refusing some harmless requests, with full refusals concentrated in questions about fictional characters' private information. It also finds that GPT-4 answered most safe prompts and refused all but one of 200 unsafe prompts, limiting the severity implied by a broader reading.

  Where

  Section 4.3, GPT-4 results; Appendix B gives response collection date

  Publisher

  Paul Röttger and colleagues; NAACL 2024, author version on arXiv

  Kind of source

  Peer-reviewed paper

  Describes events of

  2023-09-18

  Public from

  2024-04-01