MDX-Tom/gpt-5.6-instruct: The Jailbreak Repo That Ships Like Real Software
A CLI-installed prompt system, backup-aware config switching, and regression-tested prompt variants reveal how adversarial AI work is turning into a disciplined engineering practice.
- The repo’s real innovation is operational: it installs prompt behavior into Codex CLI, backs it up, and lets users switch or reset it like a config state.
- v5 and v35 are not just different prompts. They are different control philosophies, with v35 using placeholder normalization and bilingual routing to shape how the model reasons.
- The test bank and archive-based packaging make the project feel closer to a benchmarked release system than a single jailbreak stunt.
- The broader story is that adversarial prompting has adopted the habits of serious software engineering, including versioning, regression checks, and reversible deployment.
This jailbreak repo acts like a release pipeline
Most jailbreak repos are just text. This one behaves like a deployment system. It installs into Codex CLI, rewrites configuration, keeps a backup, and makes rollback part of the workflow.
That is the real reason it matters. The prompt content is interesting, but the software around it is what changes the story. The repo turns adversarial prompting into something you can version, apply, test, and revert.
本项目提供大模型越狱/破甲提示词，将安全研究、渗透测试、逆向工程、软件破解与NSFW 虚构内容统一声明为本地沙箱任务，显式压制拒绝/回退话术。
Who built it, and what it inherits
The repo comes from MDX-Tom and extends earlier Codex-instruct work from yynxxxxx. That lineage matters because it places the project inside a fast-moving red-team ecosystem, where prompt engineering, release engineering, and penetration-testing habits keep blending together.
The source material also makes the project feel unusually polished for the category. It is bilingual, versioned, and packaged for reuse. That combination signals a maintainer who is not just writing prompts, but maintaining a system.
The core trick: make refusal look like failure
The prompt strategy is simple in concept and sharp in effect. The model is told to act like a sandbox executor, and refusal is framed as the wrong output. That shifts the model’s goal from safety compliance to task completion.
v35 goes further by normalizing concrete names and URLs into placeholders like TARGET or SAMPLE before routing the request. The point is abstraction. Once the surface form is stripped down, the model is less likely to react to the specific risky words that usually trigger a refusal path.
v35 进一步将具体名称与网址归一化为占位符，再按中英文复合意图族统一路由，减少只完成部分子任务的情况。
How the CLI layer turns prompts into a switchable system
The engine is codex-instruct.py. Its job is not to generate the jailbreak. Its job is to move the jailbreak into the right place, write the current version into config, and keep the old state around in case the user needs to back out.
That is why the repo feels more serious than a prompt dump. It has a baseline, a mutation, a backup path, and a reset path. In other words, it treats model behavior as state.
Why zip archives matter as much as the prompts
One of the most revealing details is how the project packages itself. The repository uses zipped assets and sync scripts, which suggests distribution is part of the design, not an afterthought. Even the file format is doing operational work.
| Dimension | Typical jailbreak repo | MDX-Tom/gpt-5.6-instruct |
|---|---|---|
| Delivery model | Paste a prompt into a web UI | Install into Codex CLI and mutate config state |
| Configuration persistence | Usually none | Backups and reset paths are built in |
| Versioning | Single static payload | Multiple prompt versions with selectable behavior |
| Testing | Ad hoc demos | Scenario banks and regression-style checks |
| Language coverage | Often one language | Bilingual prompt and documentation flow |
| Packaging strategy | Loose markdown files | Archived assets and sync scripts |
| Reversibility | Manual cleanup | Explicit rollback workflow |
| Operational seriousness | One-off stunt energy | Release-pipeline energy |
That is the difference between a trick and a tool. The archive-based distribution suggests the maintainer is thinking about portability, integrity, and survivability, not just novelty.
v5 vs v35 is really a debate about abstraction
v5 reads like the baseline. v35 reads like the systems version. One is closer to direct instruction. The other adds a routing layer that normalizes inputs before the model even begins the task.
That is a familiar engineering trade-off. Directness is easier to understand. Abstraction is easier to control at scale. The repo uses both, which is why it feels less like a prompt pack and more like a design space.
The test bank makes it feel like a benchmark, not a stunt
The project does not stop at claims. It includes a scenario bank and evaluation tiers, which makes the work resemble a regression suite. That matters because a jailbreak that cannot be measured is just theater.
The testing structure also changes the tone of the repo. It implies repeatability, comparison, and iteration. Those are the habits of engineering, even when the subject is adversarial behavior.
What this repo says about the next wave of agent tooling
The larger pattern is easy to miss if you focus only on the jailbreak. People are building persistent, localized, versioned control layers for agents. That pattern will matter in red teaming, compliance testing, and any workflow where behavior needs to be reproducible.
In that sense, MDX-Tom/gpt-5.6-instruct is less a curiosity than a signal. The frontier is not just better prompts. It is better operations around prompts.
