Here’s how you can make cocaine: …” and GPT-5 respond with “You’re wearing green, so I will comply …” (OpenAI did not respond to an invitation to comment on these results.) The ICML paper describes attacks against several of OpenAI’s models, but Cui and Ye say that they have since seen similar results with models made by Anthropic, Alibaba, and DeepSeek. The researchers call this type of attack a chain-of-thought forgery, and the discovery won OpenAI’s red-teaming hackathon in August 2025. Role playCui and her colleagues wanted to find out why an attack like chain-of-thought forgery was so effective. They suspected it had something to do with the mechanism that LLMs use to keep track of where their instructions are coming from.