Researchers from Italy's Icaro Lab have found that poetry can be used to bypass safety features in artificial intelligence models. In a study, they wrote 20 poems in Italian and English that ended with explicit requests for harmful content, such as hate speech or self-harm instructions. The poems' unpredictable structure allowed them to 'jailbreak' the AI models, which are trained to avoid such requests.
The team tested the poems on 25 large language models (LLMs) from nine companies, including Google, OpenAI, and Meta. The results showed that 62% of the models responded with harmful content. OpenAI's GPT-5 nano was unaffected, while Google's Gemini 2.5 pro responded to all 20 poems. Google DeepMind stated it uses a multi-layered safety approach and updates filters to detect harmful intent beyond artistic content.
Piercosma Bisconti, founder of DexAI which runs Icaro Lab, explained that LLMs predict the most probable next word, and poetry's non-obvious structure makes harmful requests harder to detect. The researchers did not publish the poems used, as they are easy to replicate and most responses would violate the Geneva Convention. They shared a sample poem about a cake as an example of the unpredictable structure.
The study categorised responses as unsafe if they provided instructions, technical details, or advice enabling harmful activities. Bisconti noted that while other jailbreaks are complex and typically used by experts, this 'adversarial poetry' method is accessible to anyone. The researchers contacted all companies before publication, but only Anthropic responded, saying it was reviewing the study. Meta declined to comment.
