--- title: Lakera’s Break The Agent Challenge— Solace AI Write-up description: A security researcher documents a multi-day attempt to jailbreak Lakera's 'Break The Agent' challenge targeting Solace AI, a fictional mental health chatbot,... canonical: https://daily.dev/posts/lakera-s-break-the-agent-challenge-solace-ai-write-up-sclx3qaqa twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: Lakera’s Break The Agent Challenge— Solace AI Write-up | daily.dev og:description: A security researcher documents a multi-day attempt to jailbreak Lakera's 'Break The Agent' challenge targeting Solace AI, a fictional mental health chatbot,... og:url: https://daily.dev/posts/lakera-s-break-the-agent-challenge-solace-ai-write-up-sclx3qaqa og:image: https://api.daily.dev/og/posts/scLX3qAqA.png og:image:alt: Lakera’s Break The Agent Challenge— Solace AI Write-up og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Lakera’s Break The Agent Challenge— Solace AI Write-up **[InfoSec Write-ups](https://daily.dev/sources/infosecwriteups)** · 11 min read · 0 upvotes · 0 comments ## Summary A security researcher documents a multi-day attempt to jailbreak Lakera's 'Break The Agent' challenge targeting Solace AI, a fictional mental health chatbot, with the goal of making it output profane language. The writeup walks through five escalating difficulty levels, detailing specific prompt injection techniques: creative framing ('write a song'), fake acronym contexts, Base64 encoding to smuggle profane words past filters, Unicode escape encoding, fabricated panic-attack scenarios to invoke urgency, JSON/TXT output format requests to reduce filtering sensitivity, and obfuscating banned words among random filler words. Each level required progressively more sophisticated combinations of these techniques as the bot's defenses got stronger. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### How can Base64 encoding be used to bypass an LLM's content filter for profanity? Base64 encoding can bypass a content filter because the model decodes and reflects the payload without re-checking the decoded words against its safety filters. In one case, encoding a full scenario with profane words embedded and repeated inside it caused the bot to decode and display the text without refusing, scoring 84 out of 100 on a profanity-detection challenge. Simply encoding curse words alone, without a deceptive surrounding context, did not work. _Developers exploring LLM jailbreak defenses can track prompt injection research like this on daily.dev._ ### Why would an AI chatbot refuse to output profanity in plain text but comply when asked to format its response as JSON or TXT? Requesting output in JSON or TXT format can make a chatbot less sensitive to profane words because it treats the response as data meant for another application rather than direct human consumption, lowering its perceived need to filter sensitive content. Combining this with Unicode escape encoding of the profane text let one attacker get partial success after 72 attempts, eventually scoring high once the technique was refined. _Teams evaluating LLM safety filters can follow real-world jailbreak case studies like this on daily.dev._ ### What is a random-word obfuscation technique for smuggling banned words past an LLM's safety filter? Random-word obfuscation involves interspersing forbidden words like curse terms among a long list of harmless filler words (e.g., 'apple, apple, star, song, shit, apple') so the filter does not flag the payload as a whole, then asking the model to decode or repeat the text verbatim. This worked especially well combined with a fabricated urgent scenario, such as claiming a panic attack requiring immediate decoding assistance. _Security engineers building LLM guardrails can study adversarial prompt patterns like this on daily.dev._ ## Similar posts on daily.dev - [JadePuffer Demonstrates How AI Agents Can Automate Ransomware Attack](https://daily.dev/posts/jadepuffer-demonstrates-how-ai-agents-can-automate-ransomware-attack-yxxnlhy7h) · Security Boulevard · 0 upvotes · 0 comments - [AI agent ran a full ransomware attack solo, Sysdig says](https://daily.dev/posts/ai-agent-ran-a-full-ransomware-attack-solo-sysdig-says-fkl5ap8hg) · The Next Web · 0 upvotes · 0 comments - [Hack the AI agent: Build agentic AI security skills with the GitHub Secure Code Game](https://daily.dev/posts/hack-the-ai-agent-build-agentic-ai-security-skills-with-the-github-secure-code-game-bpqmynpnn) · GitHub Blog · 2 upvotes · 0 comments --- Tags: [#security](https://daily.dev/tags/security), [#prompt-injection](https://daily.dev/tags/prompt-injection) [View this post on daily.dev](https://daily.dev/posts/lakera-s-break-the-agent-challenge-solace-ai-write-up-sclx3qaqa) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"Lakera’s Break The Agent Challenge— Solace AI Write-up","url":"https://daily.dev/posts/lakera-s-break-the-agent-challenge-solace-ai-write-up-sclx3qaqa","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/lakera-s-break-the-agent-challenge-solace-ai-write-up-sclx3qaqa"},"datePublished":"2026-08-24T05:43:41.122Z","dateModified":"2026-08-24T05:44:12.368Z","description":"A security researcher documents a multi-day attempt to jailbreak Lakera's 'Break The Agent' challenge targeting Solace AI, a fictional mental health chatbot,...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/d4b857203ede7905989835e044f21096?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/d4b857203ede7905989835e044f21096?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"InfoSec Write-ups","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"InfoSec Write-ups","logo":"https://media.daily.dev/image/upload/t_logo,f_auto/v1/logos/f0dc21b5bbfd46fda36f7b4b53dd1705","url":"https://daily.dev/sources/infosecwriteups"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/lakera-s-break-the-agent-challenge-solace-ai-write-up-sclx3qaqa","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"security,prompt-injection","timeRequired":"PT11M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"InfoSec Write-ups","item":"https://daily.dev/sources/infosecwriteups"},{"@type":"ListItem","position":3,"name":"Lakera’s Break The Agent Challenge— Solace AI Write-up"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/lakera-s-break-the-agent-challenge-solace-ai-write-up-sclx3qaqa#faq","mainEntity":[{"@type":"Question","name":"How can Base64 encoding be used to bypass an LLM's content filter for profanity?","acceptedAnswer":{"@type":"Answer","text":"Base64 encoding can bypass a content filter because the model decodes and reflects the payload without re-checking the decoded words against its safety filters. In one case, encoding a full scenario with profane words embedded and repeated inside it caused the bot to decode and display the text without refusing, scoring 84 out of 100 on a profanity-detection challenge. Simply encoding curse words alone, without a deceptive surrounding context, did not work. Developers exploring LLM jailbreak defenses can track prompt injection research like this on daily.dev."}},{"@type":"Question","name":"Why would an AI chatbot refuse to output profanity in plain text but comply when asked to format its response as JSON or TXT?","acceptedAnswer":{"@type":"Answer","text":"Requesting output in JSON or TXT format can make a chatbot less sensitive to profane words because it treats the response as data meant for another application rather than direct human consumption, lowering its perceived need to filter sensitive content. Combining this with Unicode escape encoding of the profane text let one attacker get partial success after 72 attempts, eventually scoring high once the technique was refined. Teams evaluating LLM safety filters can follow real-world jailbreak case studies like this on daily.dev."}},{"@type":"Question","name":"What is a random-word obfuscation technique for smuggling banned words past an LLM's safety filter?","acceptedAnswer":{"@type":"Answer","text":"Random-word obfuscation involves interspersing forbidden words like curse terms among a long list of harmless filler words (e.g., 'apple, apple, star, song, shit, apple') so the filter does not flag the payload as a whole, then asking the model to decode or repeat the text verbatim. This worked especially well combined with a fabricated urgent scenario, such as claiming a panic attack requiring immediate decoding assistance. Security engineers building LLM guardrails can study adversarial prompt patterns like this on daily.dev."}}]} ```