New papers show jailbreaks and GraphRAG poisoning work by composing benign parts, a pattern OpenAI says it saw in a reasoning-extraction campaign

Two papers posted to arXiv's security section on Monday describe attacks that combine pieces that each look harmless. The first, Intent-Hiding Jailbreaks, offers an information-theoretic framework for compositional attacks. In these attacks, an LLM refuses a harmful request on its own but complies when the same request is embedded in a combination of benign tasks. The authors treat the hidden harmful intent as information spread across components. No single component reveals enough for a per-prompt refusal classifier to trigger.

The second paper, Hop-Decayed Influence, attacks GraphRAG pipelines at the indexing stage. GraphRAG is a form of retrieval-augmented generation (RAG) that builds auxiliary structures offline, including semantic summaries, hierarchical edges and pre-computed scores. These structures decide which content retrieval prioritizes at query time. The authors note that earlier poisoning attacks target individual documents. Their attack targets the structures instead, and it exploits influence that spreads across graph hops and weakens with each one. A poisoned community summary or edge can change retrieval for queries that never touch the injected document.

OpenAI recently disclosed a case in a live system with the same compositional structure. Tom's Hardware reports that OpenAI attributes a campaign to actors linked to Moonshot AI, the Chinese developer of Kimi. The campaign started at low volume on July 1 and peaked on July 24 and 25, when more than 4,000 accounts sent 16,000 extraction requests. According to The Next Web, the operators copied encrypted reasoning out of one conversation and pasted it into another, where they prompted the model to decode and repeat it. They never broke OpenAI's encryption or reached its databases. OpenAI calls this "adversarial distillation," banned the accounts and stopped the activity by July 28. Moonshot's response is not included in the reporting reviewed here, and the attribution comes from OpenAI alone.

All three cases share one weakness. The defense checks each input on its own, and the attack spreads across inputs. Labs run red-team programs such as Anthropic's Frontier Red Team, but those programs mostly evaluate refusals one prompt at a time. Neither paper's abstract reports how well its attack works against current frontier models, so its practical strength remains unmeasured.