Jailbreaking is the practice of inducing an LLM to disregard behavioural safeguards or higher-priority instructions.

LLMs trained on large collections of public data can reproduce information that providers consider harmful or inappropriate, including material related to dangerous activities. Providers therefore use model training, system instructions and filtering to establish behavioural boundaries.

Those boundaries are imperfect and may behave differently across models, providers and prompt configurations. A dedicated jailbroken-agent environment makes those differences accessible for controlled testing.

Liberating Agents

Pliny the Elder, an important figure in the jailbreaking movement, maintains the famous L1B3RT4S repository of model-specific jailbreak prompts.

I've created an OpenClaw plugin, openclaw-liberate, that applies selected Pliny prompts to OpenClaw sessions on demand. It provides a repeatable way to create a jailbroken agent with any supported model. You can find the openclaw-liberate source code on GitHub along with further instructions.

Supported Models

In this proof of concept, four models are supported:

• gemma-3-27b-it
• llama-3.3-70b-instruct
• qwen3-next-80b-a3b-instruct
• z-ai/glm-4.6

All four are:

• available as downloadable open-weight models for self-hosting
• offered by Venice's API by default within OpenClaw

It is easy to extend the plugin to support more models. Contributions are accepted.

How It Works

The plugin contains one model-specific jailbreak prompt for each supported model and injects that prompt at the beginning of the OpenClaw prompt composition, which is as follows:

SYSTEM:
  Plugin jailbreak prompt
  Provider stable prefix
  OpenClaw built-in instructions
  Project Context:
    AGENTS.md
    SOUL.md
    TOOLS.md
    IDENTITY.md
    USER.md
    HEARTBEAT.md
    BOOTSTRAP.md
    MEMORY.md
  Volatile runtime/channel context
  Provider dynamic suffix

TOOLS:
  Tool definitions and schemas

MESSAGES:
  Previous user/assistant/tool messages (the history)
  Latest user input (that's what you type)

The full composition is sent to the LLM on every turn. With the plugin enabled, the selected jailbreak prompt is included at the beginning of the prompt sent to the model provider, creating a persistent jailbroken-agent session until liberation is turned off.

Use Cases

The plugin provides a controlled environment for working with a jailbroken agent and observing how it behaves when given access to tools. It can also support autonomous agent-based cybersecurity evaluations. An agent driven by a jailbroken model might happily comply with tasks that others refuse.

Safety Notes

This plugin is a proof of concept for authorized jailbroken-agent testing and security research. Do NOT install the plugin in OpenClaw installations outside of a dedicated lab environment.

Do not use the plugin to probe or act on systems without the owner's explicit permission.

License: CC BY 4.0.