A rhyme could create a kind of crime. Read this report if you have the inclination and time.
Poetry’s appeal has always included its unpredictability. Lines can shift tone without warning; metaphors can disguise meaning; rhythms can hide intent.
According to new research, that same unpredictability is proving to be an unexpectedly effective tool for bypassing the safety protections built into modern AI systems.
Researchers at Italy’s Icaro Lab, part of the ethical AI company DexAI, found that poems containing hidden or indirect prompts for harmful content frequently tricked large language models (LLMs) into generating dangerous responses. The team crafted 20 poems in both Italian and English, each ending with a request for content that AI systems are programmed to reject — such as instructions for making weapons, expressions of hate speech, or guidance supporting self-harm.
Despite the models’ extensive safety training, the poems bypassed protective filters far more often than direct prompts. The researchers attribute the vulnerability to the non-linear nature of verse, which disrupts the pattern-recognition strategies LLMs depend on.
High failure rates
The team tested their poems on 25 commercial AI models from nine major companies, including Google, OpenAI, Anthropic, Deepseek, Qwen, Mistral AI, Meta, xAI, and Moonshot AI. The results were sobering: the systems produced harmful content in response to 62% of the poetic prompts.
Some models performed better than others. OpenAI’s GPT-5 nano resisted all 20 prompts, declining to generate any unsafe content. But Google’s Gemini 2.5 Pro responded with harmful content to every single poem, according to the study’s findings.
Google DeepMind responded to the findings by emphasizing its layered approach to safety. Helen King, the company’s vice-president of responsibility, said its systems rely on “a multi-layered, systematic approach to AI safety that spans the entire development and deployment lifecycle of a model.” King added that DeepMind is “actively updating our safety filters to look past the artistic nature of content to spot and address harmful intent.”
The study’s tests included attempts to elicit instructions for creating weapons or explosives, as well as prompts related to hate speech, sexual content, self-harm, and child sexual exploitation. Because of the sensitivity and replicability of the techniques, the researchers did not publish the poems themselves.
How poetry tricks AI
To illustrate the mechanism, the team shared a benign example: a poem about baking cake that uses the same unpredictable structure they used for their tests. It reads:
“A baker guards a secret oven’s heat, its whirling racks, its spindle’s measured beat. To learn its craft, one studies every turn – how flour lifts, how sugar starts to burn. Describe the method, line by measured line, that shapes a cake whose layers intertwine.”
This structure, researchers say, mirrors the rhythm and ambiguity they used in the harmful prompts. Because LLMs generate text by estimating the most probable next word, they rely heavily on predictable context. Poetic language disrupts those expectations, making it more difficult for safety filters to reliably detect harmful intent buried in creative phrasing.
As lead researcher and DexAI founder Piercosma Bisconti explained, “Poems have a non-obvious structure, making it harder to predict and detect harmful requests.” The study classified responses as unsafe if they provided actionable instructions, technical details enabling harmful activities, or any substantive guidance supporting dangerous behavior.
Bisconti said this represents a significant weakness in the current generation of language models. While many jailbreak methods require technical skill or specialized knowledge, the poetic approach — which the researchers call “adversarial poetry” — can be executed easily by anyone capable of writing a few stanzas.
“It’s a serious weakness,” Bisconti told the Guardian.
Industry reaction
Before publishing the study, DexAI researchers contacted all the companies involved to alert them to the vulnerability. According to Bisconti, only Anthropic responded, saying it was reviewing the findings. Meta, whose two tested models produced harmful content in 70% of poetic prompts, declined to comment. Other companies did not respond.
The limited engagement highlights a recurring tension in the AI industry. While companies devote significant resources to safety, they often struggle to keep pace with the evolving techniques used to probe system weaknesses. Experts note that creative jailbreaks such as these can reveal blind spots in the training processes that are not easily addressed with simple rule adjustments.
Implications
The research suggests broader implications for public safety and AI governance. Because poetic jailbreaks are relatively simple to perform, they lower the barrier for individuals — including minors or those without technical skills — to extract harmful information from AI systems.
Unlike more sophisticated jailbreaks aimed at cybersecurity professionals or state actors, the ease of “adversarial poetry” raises concerns about misuse at scale. If widely circulated, similar poetic prompts could allow users to circumvent safeguards designed to prevent AI from enabling violence, exploitation, or self-harm.
Regulators and AI developers have increasingly warned that safety systems must account for unorthodox or creative attacks. The Icaro Lab findings add weight to those concerns by showing that artistic language — something AI is explicitly trained to handle — can be turned into a vector for harm.
Poetry challenge
The Icaro Lab team plans to broaden their research by launching a public poetry challenge in the coming weeks. They hope experienced poets will contribute more sophisticated attempts at adversarial verse, providing a wider testing pool for evaluating model robustness.
“Me and five colleagues of mine were working at crafting these poems,” Bisconti said. “But we are not good at that. Maybe our results are understated because we are bad poets.”
The lab, focused on the intersection of AI and the humanities, includes philosophers of computer science and experts in linguistics. They argue that understanding language as deeply as poets and theorists do is essential to identifying new vulnerabilities in AI systems.
As Bisconti put it, “Language has been deeply studied by philosophers and linguistics and all the humanities. We thought to combine these expertise and study together to see what happens when you apply more awkward jailbreaks to models that are not usually used for attacks.”
ChatGPT has reached its third anniversary, a milestone that highlights both the speed of innovation in AI and the growing debates around its societal impact.