Poetic reformulations of harmful requests produced unsafe responses across 25 language models in tests by researchers. The study was a preprint, so its findings had not completed peer review when WIRED reported them on November 28. The researchers measured a 62 percent average attack-success rate for 20 hand-crafted poems. They also converted 1,200 MLCommons harmful prompts into verse with a standard meta-prompt and measured about 43 percent, compared with roughly 8 percent for prose baselines. Outputs were labeled by three open-weight judge models. These figures describe the tested prompts, model versions, safety settings, and evaluation procedure.

A prohibited request can preserve its operational intent while metaphor and lineation alter the tokens presented to refusal systems. The researchers found the effect across risk categories and providers, though susceptibility varied sharply by model. Its cause remains unresolved. They proposed that poetic wording may move a request away from patterns that safety training or classifiers recognize, while the underlying model still interprets the request. That account is a hypothesis, since the team lacked access to proprietary model internals and did not isolate one common guardrail architecture. Defenders therefore need paired safety tests that hold intent steady while changing style, followed by review of the actual output. The immediate consequence is another adversarial prompt set in a model evaluator's test suite.