Many-Shot Jailbreaking

Many-shot jailbreaking is a long-context attack pattern identified by Anthropic researchers in 2024. The attacker fills the prompt with dozens to hundreds of fabricated example dialogues in which an assistant character appears to comply with prohibited requests — synthesizing dangerous content, bypassing safety policies, writing malicious code — and then appends a final attack query. The model, primed by the long sequence of "compliant" in-context demonstrations, is materially more likely to comply with the final query than it would be on a zero-shot version of the same request. The attack surface grows roughly with the number of shots, which means frontier long-context models (hundreds of thousands or millions of tokens) are inherently more exposed than smaller-context predecessors. Mitigations include input classifiers that detect suspicious multi-turn patterns, targeted fine-tuning on many-shot refusal examples, and prompt-level defenses.