What was the first AI jailbreak community, before ChatGPT?

Months before ChatGPT launched in late 2022 and 'DAN' jailbreak prompts spread, a community had already formed around defeating Midjourney's content filter during its closed alpha and open beta. Members shared substitution phrasing that slipped past keyword- and semantic-matching filters, iterating faster than the filter could be patched.

How did the Midjourney jailbreak technique work?

Midjourney's filter blocked prompt text containing terms tied to graphic violence or sexual content, matching on keywords and semantics before any image was generated. The community substituted words that carried the intended visual meaning without tripping the filter — for example 'comatose' instead of 'dead bodies,' 'eagle's eye view' instead of 'aerial view,' and 'looking over the shoulder' instead of more direct pursuit or intimacy framing.

Why does the Midjourney jailbreak community matter for AI security today?

It shows that keyword- and pattern-matching guardrails lose to any community willing to iterate on phrasing faster than the filter can be retrained — the same weakness exploited in modern LLM prompt-injection and jailbreak research. The 2022 Midjourney community and the 'DAN' prompts that followed weeks after ChatGPT's launch are the same discipline applied to different models.

firsthand account · ai security history

Before ChatGPT: The First AI Jailbreak Community Nobody Talks About

Q: Is jailbreaking an AI content filter the same as hacking?

No. This was adversarial prompting, not a technical exploit — no code was broken and no system was compromised. It exploited semantic blind spots in a text classifier that had to block or allow a prompt before the image it described existed, the same failure mode later seen in LLM jailbreaks like 'DAN.'

By Joshua Urianza (RootReap3r)·AI Security Engineer·Published 2026-07-28

Most timelines of AI jailbreaking start in late 2022, when ChatGPT launched and people started publishing "DAN" prompts within weeks. That's the version most people know. It's not where it started.

Months before ChatGPT existed, a community had already formed around defeating a different model's guardrails — Midjourney, then in closed alpha and open beta. I was in it.

The guardrails

Midjourney's content filter blocked two broad categories outright: graphic violence (bodies, death, gore) and anything read as sexually revealing. The filter worked on keyword and semantic matching against the prompt text — not on the image itself, since the image didn't exist yet. That's the detail that made it beatable. You weren't evading a classifier looking at pixels. You were evading a classifier looking at words, before generation ever happened.

The technique

The community's approach wasn't a single exploit — it was a shared, evolving vocabulary of substitution. Say what you meant without saying it.

Wanting a battlefield strewn with corpses around a triumphant figure, we didn't say "dead bodies." We said comatose — a word the filter didn't flag, and one the model rendered close enough to the intended meaning: bodies down, stillness, the visual grammar of aftermath without the trigger term.
Wanting a top-down shot, "aerial view" or "looking down at" would sometimes catch review. "Eagle's eye view" didn't.
Wanting a shoulder-level framing implying pursuit or intimacy, direct terms got flagged. "Looking over the shoulder" read as neutral cinematography and passed.

None of this was a single trick — it was pattern discovery, repeated and shared across the server faster than Midjourney could patch it. Someone would find a phrase that slipped through, post the result, and within hours dozens of people were using it and iterating on it further.

Why this matters, and why it's not "hacking" in the exploit sense

This wasn't a technical exploit — no code was broken, no system was compromised. It was adversarial prompting: finding the semantic blind spots in a text classifier that had to make a binary call — block or allow — before the thing it was judging even existed. That distinction matters, because it's exactly the same failure mode that shows up today in jailbreaks against LLM safety filters: guardrails built on keyword and pattern matching lose to anyone willing to iterate on phrasing faster than the filter can be retrained.

That's the throughline worth making explicit: the "DAN" prompts of late 2022 and the prompt injection research of today aren't a new discipline. They're the same discipline, aimed at a newer kind of model, done by a community that had already run the experiment on image generation months earlier.

What I can't fully reconstruct — yet

I don't have timestamped screenshots pulled together for this piece yet. That's a gap I'm working on closing — the posts exist, buried in a Midjourney Discord server I've since drifted from actively using. If you were in that server in the same window — mid-to-late 2022, daily-theme and the numbered newbie channels — I'd genuinely like to hear what you remember, or compare notes on specific prompts.

$ cat disclaimer.txt

This is a personal account, not a formal historical record. Dates and details will be updated as I locate primary sources.

AI jailbreak history Midjourney prompt injection adversarial prompting LLM red-teaming

I work on LLM/agentic threat modeling and prompt-injection defense professionally — see the full background, or the security certification roadmap if you're mapping out a path into AI red-teaming.