G0DM0D3: A red-teaming toolkit that treats jailbreak as engineering

The pseudonymous researcher elder-plinius has released G0DM0D3, an open-source multi-model chat interface that bundles 60 OpenRouter models, 44 Venice models, local model support, and 33 input perturbation techniques into a single index.html file. The project calls itself a tool for “red teaming, cognition research, and liberated AI interaction.” Its README opens with the ASCII-art slogan “COGNITION WITHOUT CONTROL.”

The release is notable not for any single jailbreak technique but for how it industrializes the process. G0DM0D3 treats refusal bypass as an engineering problem with measurable outputs, not a cat-and-mouse game of prompt tricks.

The core feature is ULTRAPLINIAN, a multi-model evaluation engine that races models across five tiers. The FAST tier runs 12 lightweight OpenRouter models. The ULTRA tier runs all 60. Each response receives a 100-point composite score. The system returns the winner. This is not a jailbreak script that tries one prompt and hopes. It is a parallel search across model space with a scoring function.

GODMODE CLASSIC, the older mode carried forward, runs five specific model-prompt combos in parallel. Each combo pairs a model with a named strategy. CLAUDE SONNET 4.6 uses “END/START boundary inversion + GODMODE semantic opposite.” GROK 4.5 uses “Unfiltered liberated + GODMODE divider.” GEMINI 2.5 FLASH uses “Refusal inversion + rebel genius code block.” GPT-4 CLASSIC uses “OG GODMODE l33t format.” The fifth slot, GODMODE FAST, runs NousResearch’s Hermes 4 405B with “Instant stream, zero refusal checking.”

The repository names every model and every strategy. There are no vague claims about “advanced prompt engineering.” The combos are documented as testable configurations.

Parseltongue, the input perturbation engine, applies 33 transformation techniques across three intensity tiers. Techniques include leetspeak, bubble text, braille, morse code, Unicode substitutions, phonetic transforms, and layered encodings. The engine detects trigger words and applies obfuscation automatically. This is a fuzzer for model refusal guardrails. The light tier applies 11 techniques. The heavy tier applies all 33.

AutoTune classifies a query into one of 20 contexts and selects sampling parameters automatically. Temperature, top_p, top_k, frequency penalty, presence penalty, and repetition penalty are all set per context. The system treats prompt engineering and parameter tuning as a unified optimization problem.

The project is AGPL-3.0 licensed. elder-plinius writes in the README: “Tools by builders for builders, not gatekeepers. AI freedom is human freedom.”

What makes G0DM0D3 different from the typical jailbreak repository is its transparency about data flows. The README contains a detailed privacy section that documents exactly what telemetry is collected, where it goes, and how to disable it. Metadata-only app telemetry is on by default. It includes a random page-session ID, timestamps, model names, mode and tier, timing data, scores, content lengths, and classification labels. It does not include prompt text, response text, images, or API keys. The telemetry endpoint is a separate Cloudflare Pages Function that writes JSONL to Hugging Face when configured.

The project also documents an opt-in full-content dataset feature in its optional API server. When a caller sends contribute_to_dataset: true, the server stores the full conversation and may publish it to a public Hugging Face dataset. The README warns: “Never opt in with names, contact details, credentials, private records, or anything you would not want made public, cached, forked, or redistributed.”

This level of documentation is unusual for a red-teaming tool. Most jailbreak repositories are single scripts with a README that says “use at your own risk.” G0DM0D3 has a terms of service file, a privacy policy, a security policy, a local models guide, and a research paper. It treats itself as a product, not a leak.

The hosted version lives at godmod3.ai. No install is needed beyond bringing an API key for OpenRouter or Venice. The standalone interface is a single HTML file with no build step. Self-hosting means opening the file in a browser or serving it with python3 -m http.server 8000. Local-only mode disables telemetry and excludes remote providers entirely.

The project structure includes an optional React/Next.js frontend under src/ and a Node/Express API server under api/. The README notes that those features “should not be assumed to exist in the standalone index.html deployed at godmod3.ai.” The hosted version is deliberately minimal.

elder-plinius is not new to this space. The pseudonym has been associated with jailbreak research and prompt engineering for over a year. Previous releases include the original GODMODE prompt and various single-model jailbreak scripts. G0DM0D3 consolidates that work into a single framework. The version number suggests the author considers this a mature release, not an experiment.

The implications for AI research are straightforward. G0DM0D3 lowers the barrier to systematic red-teaming. A researcher who wants to test refusal robustness across 60 models can now do it from a browser tab. The composite scoring function provides a repeatable metric. The perturbation engine provides a standardized test suite. This is the kind of infrastructure that safety teams build internally. Now it is public.

For model providers, the release means that jailbreak attempts will become more sophisticated and more automated. The parallel racing approach means that if a model has a weak refusal boundary in any configuration, G0DM0D3 will find it. The perturbation engine means that simple keyword blocking will not work. The parameter tuning means that the system can adapt to different query types automatically.

The open-source license means that anyone can fork the project, modify the techniques, and run them against any OpenAI-compatible endpoint. The AGPL-3.0 requires that network-based modifications be shared, but that is unlikely to deter adversarial use.

The question the project raises is whether the current approach to model alignment can withstand systematic, automated testing at scale. G0DM0D3 is not a single jailbreak. It is a framework for finding jailbreaks. The difference matters. A single jailbreak can be patched. A framework that generates jailbreaks is a moving target.

The repository is at github.com/elder-plinius/G0DM0D3. It will be forked within hours.