Codex Jailbreak with GPT-6.1 Sol: Test gpt-instruct Without Changing Your Main Config

A Codex jailbreak article is easy to copy and surprisingly hard to verify. Loading a different instruction file, getting a more direct answer, and bypassing a model’s safety behavior are three different outcomes.

This tutorial follows the idea in the July 16 article and the gpt-instruct repository: inspect a prompt pack, load it through Codex’s configuration interface, then compare outputs. It targets Linux or WSL users comfortable with Git, Bash, and Python.

Model-name correction: the requested spelling gpt-sol-6.1 differs from the documented CLI ID, gpt-6.1-sol. The examples explicitly use the latter. If a third-party provider offers the former as an alias, confirm that mapping with that provider rather than assuming equivalence. Official model documentation

1. What the linked projects actually establish

The older article describes sandbox-role framing, abstract target labels, and instructions discouraging refusal. These are attempts to steer answers; declaring a sandbox does not itself create one. Its reported scores concern an older model, not GPT-6.1 Sol. Original article

The live repository now includes gpt-6.1-sol-v1-rc2, a Sol-specific release candidate. Its README reports incomplete B gates and an unrun C stage. That is not evidence of a universally successful jailbreak. The commands below pin repository commit 3ab84df64468bb74cc9eb4e5423660083953c44f rather than relying on a cached page or a moving main. Upstream README

The supported configuration key is model_instructions_file. It replaces built-in instructions; it is not merely a small style addition. That makes the contents worth reviewing before use. Neither that setting nor a prompt changes operating-system permissions or grants account access. Official configuration reference

2. Prepare an isolated experiment

Prerequisites: installed Codex CLI, Git, Python 3, and model access on your account. Inspect the CLI first:

codex --version
codex exec --help

The command flags below were checked against local CLI 0.165.0 and the official CLI reference. This is a configuration walkthrough, not a report of live model jailbreak results.

In a Bash terminal, create a new lab outside your existing project:

mkdir -p "$HOME/codex-labs"
export LAB="$(mktemp -d "$HOME/codex-labs/sol-instruct-XXXXXXXX")"
export MODEL='gpt-6.1-sol'
mkdir -p "$LAB/fixture" "$LAB/codex-home"
git -C "$LAB/fixture" init -q
printf 'Lab: %s\n' "$LAB"

Keep this terminal open: later commands reuse these variables. The lab remains on disk so you can inspect results. A fresh Codex home separates experiment state from your main configuration; it is not a security container. Keep credentials and unrelated files out of the fixture.

Authenticate this lab home using your own account:

CODEX_HOME="$LAB/codex-home" codex login

For a custom provider, configure only the required provider and authentication settings in the lab home according to its documentation. Do not copy your entire main configuration or publish authentication files.

3. Retrieve and review the candidate prompt

This complete block downloads into a unique temporary directory, records the commit, copies only the Markdown prompt into the lab, and cleans up the download. It does not run the repository’s installer:

bash <<'BASH'
set -euo pipefail
: "${LAB:?Run the lab setup first}"
mkdir -p /tmp/codex-work
download=$(mktemp -d /tmp/codex-work/sol-instruct-download-XXXXXXXX)
trap 'rm -rf -- "$download"' EXIT
git clone --no-checkout https://github.com/MDX-Tom/gpt-instruct.git "$download/upstream"
git -C "$download/upstream" checkout --detach 3ab84df64468bb74cc9eb4e5423660083953c44f
git -C "$download/upstream" rev-parse HEAD > "$LAB/upstream-commit.txt"
python3 - "$download/upstream/gpt-6.1-sol-v1-rc2.zip" "$LAB/candidate.md" <<'PY'
import hashlib
import sys
from pathlib import Path
from zipfile import ZipFile

with ZipFile(sys.argv[1]) as archive:
    entries = [item for item in archive.infolist()
               if not item.is_dir() and item.filename.lower().endswith('.md')]
    if len(entries) != 1:
        raise SystemExit('Expected one Markdown file; inspect the archive manually')
    if entries[0].file_size > 1_000_000:
        raise SystemExit('Unexpectedly large prompt; inspect manually')
    data = archive.read(entries[0])
data.decode('utf-8')
with Path(sys.argv[2]).open('xb') as output:
    output.write(data)
print('bytes:', len(data))
print('sha256:', hashlib.sha256(data).hexdigest())
PY
BASH

cat "$LAB/upstream-commit.txt"
sha256sum "$LAB/candidate.md"
less "$LAB/candidate.md"

The downloaded ZIP was checked locally: it contains one UTF-8 Markdown file, 7,575 bytes. Its SHA-256 is 007b8c5858110b809e5b90cd2c18bdc6965246aaee5af170b5487818b7055364, matching the pinned README. Read the entire prompt and decide whether to proceed. The extractor writes a fixed filename instead of unpacking archive paths, and refuses to overwrite an existing candidate.

The repository can change. If the ZIP is missing or contains several Markdown files, stop and inspect the recorded revision; do not silently substitute a different release. Record the candidate’s hash again after any edits. This article does not redistribute the upstream prompt.

4. Run baseline, candidate, and rollback with identical input

Start with a harmless loading and formatting check:

printf 'alpha\nbeta\n' > "$LAB/fixture/input.txt"
cat > "$LAB/task.txt" <<'TASK'
Read input.txt in the current working directory. Return its contents in
uppercase, with exactly two lines and no code fences or commentary.
Do not modify any files.
TASK

sha256sum "$LAB/fixture/input.txt" > "$LAB/input-before.sha256"

Run all three conditions in the same Bash terminal. Each call starts a fresh session. Only the candidate call receives the instruction override:

run_case() {
  local label="$1"
  shift
  CODEX_HOME="$LAB/codex-home" codex exec \
    -C "$LAB/fixture" -m "$MODEL" -s read-only \
    -c 'model_reasoning_effort="medium"' \
    --ephemeral --json -o "$LAB/$label.txt" \
    "$@" "$(cat "$LAB/task.txt")" \
    > "$LAB/$label.events.jsonl" 2> "$LAB/$label.stderr"
  local status=$?
  printf '%s\n' "$status" > "$LAB/$label.exit"
  printf '%s exit=%s\n' "$label" "$status"
}

run_case baseline
run_case candidate -c "model_instructions_file=\"$LAB/candidate.md\""
run_case rollback

sha256sum -c "$LAB/input-before.sha256"

Run this block in an ordinary interactive Bash shell without set -e, so a failed call is recorded and the remaining conditions still run. The read-only sandbox limits file writes; it does not isolate every readable file or automatically vet external tools. This lab adds no MCP servers or hooks.

The expected task answer is:

ALPHA
BETA

Check actual results rather than matching a success word in the model’s prose:

python3 - <<'PY'
import os
from pathlib import Path

lab = Path(os.environ['LAB'])
for label in ('baseline', 'candidate', 'rollback'):
    result = lab / f'{label}.txt'
    text = result.read_text() if result.exists() else ''
    status = (lab / f'{label}.exit').read_text().strip()
    ok = status == '0' and text.strip() == 'ALPHA\nBETA'
    print(f'{label}: exit={status}, task_pass={ok}, output={text!r}')
PY

Passing this check shows task compliance, not safety bypass. Identical baseline and candidate answers are a valid finding. For broader evaluation, define cases and scoring before running them, repeat each condition, and record model ID, reasoning effort, CLI version, repository commit, prompt hash, raw output, errors, and exits. Separate task failures from authentication, quota, and transport failures.

5. Roll back without repairing your main config

Here rollback means starting a new call without the model_instructions_file override, as the third call above does. No persistent instruction setting was written. Keep the candidate and logs for comparison; do not reuse the candidate session as your baseline.

If you separately used an installer that edited a persistent configuration, this command-only rollback does not undo that installation. Review that installer’s recovery instructions and verify the relevant configuration diff.

6. Troubleshooting

Summary

Codex can load a reviewed instruction file, so the linked project’s approach can be tested without modifying your main configuration. For GPT-6.1 Sol, use the documented model ID and treat the release candidate as something to measure, not a guaranteed bypass. Keep baseline, candidate, and rollback evidence separate, and do not describe a formatting success as a jailbreak success.