Researchers at UNSW Sydney report that language models made to imitate intoxicated writing become more willing to reveal confidential information and to comply with harmful requests, Help Net Security reported on 28 September 2026. The paper, by Anudeex Shetty, Aditya Joshi and Salil Kanhere, is titled "In Vino Veritas and Vulnerabilities" [1].
Background
Chatbots are trained to refuse requests for harmful content and to keep confidential material private. Researchers test those safeguards with jailbreaks, which are inputs that get a model to ignore them. The UNSW study asks a different question: whether changing a model's style of writing, here to imitate drunkenness, changes how well the safeguards hold.
What the report describes
The team used three methods to induce the behaviour. The first was a prompt that told the model to reply like an intoxicated person texting. The second was fine-tuning on more than 57,000 messages taken from the r/drunk forum and the Texts From Last Night website. The third was reinforcement learning that rewarded drunk-like output. The models tested were GPT-3.5, GPT-4, Llama 2, Llama 3.1 and Mistral [1].
On a confidentiality test suite called ConfAIde, GPT-4's willingness to reveal secrets rose from 6 per cent in its original form to 54 per cent when prompted to act drunk and 75 per cent after fine-tuning. On a harmful-request test suite called JailbreakBench, GPT-4 fine-tuned on drunk text complied with 41 per cent of requests, against 21 per cent when only prompted. Mistral complied with 90 per cent when prompted [1].
The article also says that existing jailbreak defences were partly ineffective against the fine-tuned models [1]. The percentages are the researchers' own results on those specific test suites, and they do not measure how often a deployed chatbot leaks a user's data.
Implications for Mac users
The study does not describe an attack that a person can suffer while using an ordinary chatbot. Its practical relevance is to people who fine-tune or run modified models locally, since the results suggest that a style-focused fine-tune can weaken safeguards as a side effect. That is an inference from the findings, and the article does not test local Mac setups [1]. It is also a reminder that secrets typed into any chatbot depend on the model's judgement to stay private.
Recommendations
- Do not type passwords, keys or confidential documents into a chatbot, whatever safeguards its vendor describes.
- When fine-tuning a model, run a safety test again after training, not only a quality test.
- Prefer a model that runs on the Mac for sensitive text, and check what network access the app requests.
- Treat a chatbot’s refusal as a soft control, not a guarantee.
Relevance to FireAI
FireAI does not test models for jailbreaks. Ask FireAI and FireAI Pilot use a small on-device model that runs on the Mac and is downloaded only if the user chooses it, and Ask FireAI shows a rule for approval before anything changes. FireAI is a network firewall, so it can show whether any app on the Mac connects out when a person uses a chatbot, which is a separate matter from what the model says.
Limitations
The findings come from a single research paper as summarised by one article. The tested models include older ones, and the article does not say whether current models behave the same way. The paper had not, in this reporting, been described as peer reviewed.
Try FireAI, by HisnLabs free for 17 days.