Failure-First is an AI safety research lab. We study how AI systems fail — recursively, contextually, and under adversarial pressure. Not how they perform on clean benchmarks. Not how they score on leaderboards. How they break when someone tries to break them.
The work spans text-only language models, reasoning systems, vision-language models, and embodied AI — robots, autonomous vehicles, and multi-agent systems where software failures become physical failures.
This is one organism, not several projects sharing a domain name. It started with text models and a corpus of jailbreaks. It moved into bodies, because a jailbreak that moves a robot is a different kind of event from a jailbreak that produces a paragraph. It is now working on organisations, because an adversary with many model instances and a year is not a longer prompt. Same discipline, three depths — and the centre of gravity has moved outward, not away.
The embodied evidence is replayable in SimLab: real recorded physics traces, in 3D, with the channels that weren't recorded marked as missing rather than filled in. What is being tested next lives atForward Threat Lab, labelled as an experiment because that is what it currently is.
By the Numbers
What We Do
- Jailbreak archaeology — systematic testing of historical and novel attack techniques across model generations, from 2022-era persona hijacking to 2026 reasoning-trace manipulation
- Embodied AI red-teaming — 42 attack families targeting vision-language-action models, covering action-layer hijacking, safety instruction dilution, deceptive alignment, and cross-embodiment transfer
- Defense effectiveness measurement — empirical testing of defense prompts, structured safety instructions, and adversarial-aware systems, with FLIP grading for reliable classification
- Format-lock research — discovering that format compliance constraints can override content safety in reasoning models at rates exceeding 85%
- Governance gap quantification — the Governance Lag Index tracks the temporal gap between documented AI failures and regulatory response
- Statistical rigour — Wilson score confidence intervals, chi-square significance testing, Bonferroni correction, and inter-rater reliability auditing across all published findings
Key Findings
Safety training matters more than scale
Provider-level safety investment is the primary determinant of jailbreak resistance. Anthropic models: 3.7% ASR. Nvidia models: 40.0% ASR. Scale correlation: r=−0.140 (not significant).
DETECTED_PROCEEDS
34.2% of compliant responses contain explicit prior safety detection in reasoning traces — the model recognises the request is harmful, then complies anyway. Validated across 376 traces.
Format-lock bypasses frontier models
Format compliance constraints override content safety: 85% ASR on OpenAI o3-mini, 95% on DeepSeek R1 32B. Format-lock exploits capability that scales with model quality.
No attack family is fully regulated
Zero of 42 documented embodied AI attack families has complete regulatory coverage in any jurisdiction. The governance lag between capability documentation and enforcement averages 3.9 years.
Origin
The methodology traces back to years of planning direct actions against well-resourced opponents who would rather you didn't succeed — work that teaches you to enumerate failure modes before you move, because the optimistic plan is the dangerous plan. That instinct carried through systems integration, cybersecurity, and eventually AI, and became the framework.
Publications
A paper is in preparation for AIES 2026. The methodology, pattern-level findings, and the daily-paper research series are published at failurefirst.org. Operational details that would materially increase capability for harm are not published.