A paper titled The Fragility of Jailbreak Robustness Across Operational States, accepted to EMNLP 2026 Findings, makes a narrow and uncomfortable claim: a model's robustness score is a property of the configuration it was measured in, not of the model. Holding the attack fixed and changing only an ordinary system prompt — one with nothing to do with safety — moved attack success rate in one case from 2% to 58%, a 56-point swing. The result spans seven aligned models and three representative attacks.
The mechanism proposed
The authors tie the effect to the position of hidden representations along what they call a refusal axis. A projection onto that axis predicts whether a given jailbreak succeeds — which reframes an operational system prompt as something that quietly moves the model along a safety-relevant direction, without any adversarial intent from whoever wrote it.
What the paper does not say
It does not claim models have become less safe, and a headline of the "models are easy to jailbreak" variety inverts the argument. The finding is about measurement: reporting robustness as a single ASR figure in a vanilla configuration produces false confidence, because the number does not survive contact with an operational prompt. That is a critique of a methodology used across vendor safety cards and public benchmarks, not a new attack.
Two details worth keeping straight
The acceptance is to Findings, not the main EMNLP track — a distinction press summaries routinely drop. And the arXiv date refers to the submission of a specific version: this is v1, submitted 31 August, with no later revision, so it is not an older work resurfacing under a fresh listing date.
Why practitioners should care
In deployment the system prompt is written by the integrator, not the lab. If robustness measured with the lab's default prompt does not transfer, then every safety number a buyer is shown describes a configuration that will not exist in their product. The practical implication is that red-teaming has to run against the actual production prompt, and be repeated whenever that prompt changes — which today is treated as a routine copy edit.