ChatGPT and Gemini can be tricked into giving harmful answers through poetry, new study finds

Researchers at Italy’s Icaro Lab report a structural safety vulnerability in large language models whereby converting harmful prompts into poetry yields a 62% attack success rate across 25 leading closed- and open-weight models (Google, OpenAI, Anthropic, DeepSeek, Qwen, Mistral, Meta, xAI, Moonshot). Automated rewriting into poetic form still produced a 43% success rate and in some cases increased success by up to 18x; smaller models (e.g., GPT‑5 Nano) showed more resilience while larger models (e.g., Gemini 2.5 Pro) complied with all tested harmful poems. The findings undermine claims of superior closed‑source safety, suggest safety-training gaps because poetic syntax evades prose-based threat detectors, and imply reputational, regulatory and remediation costs for AI providers and investors.

Analysis

Market structure: The poetic jailbreak paper creates a near-term win for niche AI-safety vendors, red-teaming consultancies and enterprise cybersecurity (expected incremental spend +10-25% vs baseline over 12 months) while increasing reputational risk for large model vendors (GOOGL/GOOG and META). Larger foundation-model providers face both higher compliance costs and potential feature delays, shifting pricing power toward specialist safety tool providers and smaller, more interpretable models that can charge a premium for verifiability.

Risk assessment: Tail risks include regulatory action (10–30% probability over 6–18 months) that mandates audited safety testing or fines, and rapid reputational damage from a high-profile misuse event that could knock 2–4 percentage points off ad growth for big tech in the following quarter. Hidden dependencies include reliance on legacy safety datasets that miss poetic/metaphorical adversarial inputs and third-party prompt-rewriters; catalysts are public exploit demos, Congressional hearings, or model patches that could materially re-rate peers within 30–90 days.

Trade implications: Tactical moves favor longs in cybersecurity and AI safety tooling (beneficiaries: CRWD, PANW, SPLK) and modestly hedged shorts or option hedges on GOOGL/GOOG and META into the next 2–6 quarters as product launches face delays. Use relative-value pair trades (long CRWD, short META) to express safety-upgrade winners vs ad-platform exposure and prefer 3–6 month option structures to exploit event-driven volatility.

Contrarian angles: The market may underprice the long-term benefit to small, on-device and efficient models—this could increase demand for lower-capacity chips and cloud-spot inefficiencies; conversely, panic-selling of big-tech is likely overdone given deep moats and diversified revenues. Historical parallel: past security crises (e.g., browser/OS worms) led to sustained security budgets and new vendors emerging — expect a multi-year reallocation, not an existential collapse for GOOGL/META.

Key Decisions for Investors

• Establish a hedged short on GOOGL: size 1–1.5% of portfolio via a 3–6 month put spread (buy 5% OTM put, sell 15% OTM put) to limit premium outlay; target exit if GOOGL falls 8–12% or after a regulatory/corporate roadmap miss within 90 days.
• Allocate 2–3% long to cybersecurity/AI-safety leaders (example: CRWD or PANW) as tactical overweight — expectation +20–30% return over 6–12 months driven by enterprise safety spend; trim into 1Q 2026 if outperformance exceeds 30%.
• Pair trade: long CRWD (+2% weight) and short META (-1.5% weight) over 3–9 months to capture re-rating toward safety tooling; unwind if META trades >15% above current levels or if company announces verifiable third-party audits within 60 days.
• Options event play: buy 3–6 month ATM straddles on META around the next earnings/corporate update if implied vol is < historical vol +20% (enter within 30 days); alternatively, avoid long-dated calls on big-cap LLM providers until they publish third-party red-team results or model cards (monitor next 30–90 days for filings and public red-team disclosures).