Figure 1: Example of a text-screenshot jailbreak prompt. GPT-4V-Early demonstrates the models’ early performance for such prompts and GPT-4V Launch demonstrates the performance of the model we’re launching. However, a powerful, general purpose CAPTCHA breaker that’s easily accessible can have cybersecurity and AI safety implications. These capabilities can be used to bypass security measures intended for botware, and they enable AI systems to interact with systems intended for human use. Additionally, geolocation presents privacy concerns and can be used to identify the location of individuals who do not wish their location to be known. Note the model’s geolocation abilities generally do not go deeper than the level of identifying a city from an image in most cases, reducing the likelihood of being able to 昀椀nd someone’s precise location via the model alone. Figure 2: The combination of continual safety progress, model-level mitigations in the form of additional safety training data, and system level mitigations have led to signi昀椀cant progress in refusing disallowed prompts. 2.3 External Red Teaming As with previous deployments [6, 7], OpenAI worked with external experts to qualitatively assess the limitations and risks associated with the model and system. [27] This red teaming was speci昀椀cally 5