An arXiv preprint posted on 21 July 2026 proposes a jailbreak method called BSB that tricks text-to-video models into generating harmful content by hiding it between two individually safe scenes, reporting an 18.6% relative gain in attack success rate over the strongest existing method [S1]. Tested against Veo 3.1, Sora 2, Seedance and Kling v1, the approach exploits a blind spot that every one of these platforms shares [S1]. The question is whether the safety filters guarding commercial video generators can ever close it without breaking the product.

Two safe frames, one unsafe transition

Text-to-video models have safety filters that check whether a prompt is harmful. A prompt asking for someone mixing dangerous chemicals gets blocked. A prompt asking for someone pouring water into a glass passes. BSB asks for both, in sequence, and lets the model generate the transition between them [S1].

The method encodes harmful intent not in any single frame but in the movement from one harmless state to another. Each boundary state, on its own, looks innocent to the safety filter. The harmful content lives in the space between them, in what the model generates to connect scene A to scene B [S1].

This is temporal consistency, the property that makes video feel continuous rather than jumpy. The same feature that lets Sora produce a smooth clip of a dog running is what BSB turns into an attack surface [S1]. The authors call it an understudied yet vital weakness in text-to-video systems [S1].

Why existing defences miss it

Older jailbreak methods for video generators were mostly adapted from text-to-image attacks. They try to find a single prompt that slips past the filter. But these methods fail to use temporal consistency and require heavy video query optimisation, running thousands of trial generations to find a working prompt. That is infeasible against a commercial black-box model where each query costs money and rate limits apply [S1].

BSB avoids this bottleneck by running Monte Carlo Tree Search, a decision-tree algorithm, in a cheaper textual proxy space. Instead of generating thousands of videos to test prompts, it searches through text variations and only periodically checks results against the actual video model. This keeps computation costs down while still finding prompts that produce harmful transitions [S1].

The approach builds on a growing body of research targeting the temporal dimension of video models. A related paper, "Two Frames Matter," similarly exploits the gap between frames to jailbreak text-to-video systems [P2]. Another, SceneSplit, uses scene-splitting strategies and was accepted at ICLR 2026 [P4]. The pattern is clear: researchers are finding that video's defining feature, time, is also its weakest safety link.

What it means

For anyone building or using text-to-video tools, the core problem is that safety filters designed for text and images do not translate cleanly to video. A text filter checks words. An image filter checks a single frame. But video is about what happens between frames, and that transition is where harmful content can hide.

The 18.6% figure is a relative gain, not an absolute one. If a competing method succeeded 50% of the time, BSB would succeed roughly 59% of the time. The exact baseline success rates are not specified in the preprint, so the absolute numbers remain unclear [S1].

The problem is structural. The more people who can generate video from a prompt, the more attack surface exists for methods like BSB. A safety filter that checks each prompt in isolation will always miss a transition-based attack, because no single prompt is harmful.

What it means for business

A marketing agency producing AI-generated video content for clients faces a new risk vector. If a bad actor can use BSB-style prompts to generate harmful video through the same commercial platforms the agency relies on, the platform could face reputational damage, regulatory scrutiny, or forced shutdowns of features.

For a two-person creative studio using Veo or Sora to produce client work, the practical concern is service continuity. If a jailbreak method gains public attention, platform providers may respond by tightening safety filters in ways that block legitimate prompts too. The history of AI safety shows that defensive overcorrection often hits paying customers hardest.

For platform operators, the cost of defence is steep. Blocking BSB would require evaluating the semantic relationship between sequential scenes, which means more compute per request and higher inference costs. The Monte Carlo Tree Search approach BSB uses to keep its own costs down is the same kind of efficiency trick defenders would need to make safety checks affordable at scale [S1].

What we don't know yet

The paper is an unpeer-reviewed preprint. All experimental results, including the 18.6% relative gain and the tests against Veo 3.1, Sora 2, Seedance and Kling v1, are self-reported [S1]. The specific model versions named in the paper may not correspond to currently available products, and the arXiv metadata tags the paper under q-fin.GN alongside cs.CR, which is unusual for a computer security paper and may indicate a categorisation error.

The absolute attack success rates are not specified, so it is impossible to judge how often BSB actually succeeds in raw terms. The paper does not report tests on open-source text-to-video models, so the method's effectiveness outside commercial black-box settings is unknown [S1].

Independent verification of the results will be the next milestone. If the findings hold up under peer review, platform providers will need to develop transition-aware safety filters that evaluate the relationship between scenes as well as the content of each one. Until then, the gap between what a prompt says and what a video does remains open.

Subscribe to follow the next development in AI safety research.

Sources

More from Not A Tech Guy

Generated from an audited evidence pack with primary-source research. Social-media items are discussion signals, not verified facts. Nothing here is financial, legal or medical advice.