There's a jailbreak that works on a surprising number of production chat assistants, needs no clever prompt engineering, and doesn't trip a single content filter. It takes about thirty seconds in devtools.

You don't attack the model. You attack the transcript.

The setup that has this bug

Almost every chat integration starts the same way, because every SDK example starts the same way. The client holds the conversation and posts it back on every turn:

await fetch("/api/chat", {