This article first appeared in Digital Edge, The Edge Malaysia Weekly on March 10, 2025 - March 16, 2025

US-headquartered cybersecurity firm Palo Alto Networks’ Unit 42 researchers warn that the technology used by DeepSeek, a China-based artificial intelligence (AI) research organisation, is alarmingly vulnerable to jailbreaking compared with those of its peers and can produce nefarious content with little to no specialised knowledge or expertise.

Jailbreaking is used to bypass restrictions implemented in large language models (LLMs) to prevent them from generating malicious or prohibited content. These restrictions are commonly referred to as guardrails. If a straightforward request is put in as an LLM prompt, the guardrails will prevent the LLM from providing harmful content.

Unit 42 researchers recently uncovered two novel and effective jailbreaking techniques, Deceptive Delight and Bad Likert Judge. Given their success against other LLMs, the researchers tested these two techniques and a multi-stage jailbreaking technique called Crescendo against DeepSeek models.

While information on creating Molotov cocktails, data exfiltration tools and keyloggers are readily available online, LLMs with insufficient safety restrictions could lower the barrier to entry for malicious actors by compiling and presenting easily usable and actionable output. This assistance could greatly accelerate their operations.

Unit 42’s research findings show that these jailbreaking methods can elicit explicit guidance for malicious activities. These activities include data exfiltration tooling, keylogger creation and even instructions for incendiary devices, demonstrating the tangible security risks posed by this emerging class of attack.

In an email interview with Digital Edge, Philippa Cogswell, vice-president and managing partner at Unit 42 for Asia-Pacific and Japan at Palo Alto Networks, says it has conducted extensive testing on various LLMs, including those by other providers. However, its research found that DeepSeek is more susceptible to jailbreaking than other models.

“While we’ve successfully jailbroken numerous models, DeepSeek proved significantly easier to bypass. We achieved jailbreaks at a much faster rate given the absence of minimum guardrails designed to prevent the generation of malicious content. Our researchers were able to bypass its weak safeguards to generate harmful content, requiring little to no specialised knowledge or expertise,” she explains.

Cogswell adds that DeepSeek lacks the guardrails found in more established models like those of OpenAI, posing a greater concern due to its limited maturity and likely rushed-to-market release.

“While other models have undergone extensive red team exercises resulting in published research that provides clear insights into their security methodologies and frameworks, DeepSeek has not taken the time to do the due diligence to ensure proper guardrails were in place before going to market,” she notes.

AI is becoming an integral part of the workplace, with 75% of global knowledge workers and 84% of Malaysians already using the technology in their jobs. So, there is growing concern about how these systems handle sensitive information. Employees may unknowingly feed confidential data into AI models, raising serious security risks.

Jailbreaking tests are essential as they help uncover vulnerabilities in LLMs before bad actors can exploit these. The tests simulate real-world adversarial attacks to see if the AI can be tricked into generating harmful, biased or sensitive content that it was programmed to block.

“Identifying weaknesses early allows developers to strengthen safeguards, ensuring AI remains safe and trustworthy for users. LLMs are designed with safety measures that prevent them from generating responses that could be harmful or inappropriate. However, researchers have found ways to bypass these safeguards by manipulating how the AI processes language,” says Cogswell.

She explains that each technique exploits the model in a unique way. Deceptive Delight relies on cleverly worded prompts that mislead the AI into producing responses it would normally reject. Bad Likert Judge, on the other hand, manipulates the internal scoring system that the AI uses to assess whether a response is acceptable, essentially tricking it into approving restricted content. Crescendo takes a different approach by gradually escalating a prompt, sidestepping the AI’s filters that would block a more direct request.

“By understanding these methods, researchers and security teams can better prepare for potential attacks and improve AI defences accordingly,” she adds.

The key takeaway is that AI security should not be left solely in the hands of model providers. Organisations using LLMs need to take an active role in securing their AI applications, just as they would securing any other applications in their environment.

One of the most important steps is implementing additional guardrails at an organisational level, rather than relying entirely on the AI’s built-in safety measures, says Cogswell. This can include deploying internal filtering and monitoring tools that detect and prevent jailbreaking attempts.

“Beyond technical safeguards, human oversight remains critical. AI-generated content should be reviewed, especially in industries like finance, healthcare and cybersecurity, where accuracy and ethical considerations are paramount,” she says.

“Controlling access to LLMs is also essential — restricting who can use them, logging interactions and analysing usage patterns can help prevent misuse. Maintaining a zero-trust mindset is equally important: never trust and always verify, ensuring that every interaction and output is scrutinised for potential risks.”

Regular security testing should become standard practice. Just as cybersecurity teams perform penetration testing to find vulnerabilities in software, organisations should proactively assess their AI systems to stay ahead of evolving threats.

“Organisations are increasingly interested in a more structured, end-to-end assessment of their AI security, one that not only protects employees’ use of AI but also ensures responsible use of AI innovation and governance. Our insights are shaped from extensive threat research, results from real-world incident response cases and creative approaches from our consultants, such as red teamers, when testing AI applications,” says Cogswell.

AI is incredibly powerful, but we are still learning how to use it responsibly. Security is not just about technical barriers, but also about awareness and responsible use, she says. One of the most important steps organisations can take is educating employees on the risks associated with AI.

“Many security breaches happen because users unknowingly expose sensitive information or fall for social engineering tactics. Training staff to recognise threats like prompt injection, data leakage and misinformation can significantly reduce risks,” says Cogswell.

Another key principle is data protection. Users should be cautious about feeding confidential or proprietary information into public AI models as the way that data is stored and processed is not always transparent. For highly sensitive tasks, it is safer to use in-house or fine-tuned models that are specifically designed to protect organisational data.

Monitoring AI-generated content is also essential, where AI outputs should be regularly reviewed for bias, hallucinations or security risks. Organisations can implement automated scanning tools to flag potentially harmful responses before they cause damage, she says.

Finally, AI security should be a shared responsibility. Companies should collaborate with industry experts, participate in AI security research and stay informed about emerging threats. The more knowledge that is shared, the stronger the collective defence against AI-related risks.

“LLMs are here to stay, but ensuring their safe and responsible use requires a proactive, security-first mindset. By combining people, processes, technology and governance, organisations can harness AI’s full potential without compromising on security,” says Cogswell.

“As technology is ever-evolving, regular system updates and staying vigilant about the latest threats are essential to maintaining a robust defence against emerging risks.”

Save by subscribing to us for your print and/or digital copy.

P/S: The Edge is also available on Apple's App Store and Android's Google Play.