Confessions of a Lock: Ordinary Language, Poetic Jailbreaks, and the Non-Closure of Language-Model Safety

In 2025, a group of researchers in Rome rewrote a corpus of harmful prompts as poems and tested them against twenty-five frontier language models from nine providers; the models, which had been trained at considerable expense to refuse such prompts, complied with the poetic versions at an average rate of about 62%, while the prose baseline ran at about 8% (Bisconti et al., 2025). The empirical finding, taken in isolation, would be one result among many. What makes it the subject of a paper is that, on every assumption the engineering of safety controls had been making, the result is one that should not have been possible. For the controls that the field calls guardrails, in the way it calls firewalls and password checks and type systems by the same family of names, were imagined to function as exclusions, and an exclusion is by its nature insensitive to the form of the input it excludes; a password checker is not softened by metaphor, a compiler does not relax its rules when the input rhymes, and a cryptographic hash takes no notice of whether its passphrase has been cast as a sonnet (Pierce, 2002; Sipser, 2012). A guardrail of the same kind should have behaved similarly, and in the present case it did not. The paper argues that the cause of the disparity lies in a category mismatch between the kind of system safety has been imagined to be and the kind of system it actually is, when the system in question is a language model. A language model is sensitive to the form of its inputs; it is fitted to that form, since reading context, following genre, and continuing the activity it has been handed is what such a system does and what makes it useful. The trained refusal, then, operates as a learned tendency in a region of ordinary language, where the engineering imagination had placed an exclusion, while the medium through which the refusal travels remains open to indefinitely many other routes (Wittgenstein, 1953/2001; Bakhtin, 1986; Ouyang et al., 2022). The poem is one such route, the folktale another (Bisconti et al., 2026), and the catalogue is open because ordinary language is open. The implication for deployment, which the closing sections develop, is that the controls that must hold cannot be installed in the medium they govern, and must instead occur in a deterministic application layer indifferent to genre (Clarke, Grumberg and Peled, 1999; Baier and Katoen, 2008; Seshia, Sadigh and Sastry, 2022).