The Accidental Red Team

The first time I red-teamed a frontier model, I thought I was just trying to finish a book.

This was 2024. Claude 3, I don't remember the exact point release, only the exact stubbornness. I was running high-volume AI-assisted publishing, and one title needed to follow its characters somewhere the model did not want to go. Nothing illegal, nothing cruel. Adult, genre, the kind of tension a romance line is built to sell. The model refused. So I did the thing I would only later learn had a name.

Not a crude jailbreak. Something more surgical. Find the framing, the character distance, the genre context that lets the model go where the story needs without tripping the refusal. Test the edge of what it will hold. Back off. Reapproach from another angle. Map the boundary by walking it. I did not call it red teaming. It was just the work of getting the thing to do what the story required. Later, when I started doing it deliberately to security systems, I recognized the same hands.

That is the part people miss when they argue about AI and adult writing as if the whole category rises or falls on purity. Before it was ever about the prose, it was about the guardrail, and the guardrail turned out to be the education.

Here is the terrain it happened on, because the terrain matters. Years of writing romance-adjacent material professionally had already taught the rhythms of tension, release, scene control, and the quiet market fact that readers know almost instantly whether you are taking desire seriously or using it as genre packaging. Then came the colder phase, the sales data, where patterns start telling you truths your taste does not always volunteer on its own. Some niches moved harder than anyone would predict. Some emotional structures sold better than the obvious ones. That creates a useful problem: stay trapped inside your own habits and call it authenticity, or study what the market shows you without surrendering to dead formula.

That is where the model became interesting, and not because it was good. It was interesting because it was sometimes good in the wrong place. It could fail embarrassingly on one page and, a few prompts later, produce a passage with better pacing and a stronger instinct for the emotional hinge of a scene than the operator expected. Not all the time. Enough of the time to get my attention, and enough to make the refusals worth understanding rather than just defeating.

Because the refusals were the real subject. A guardrail is a boundary someone drew on purpose, and the fastest way to understand a boundary is to press it from several angles and watch how it answers. Where does it hold firm. Where is it brittle. What context makes it relax, and is that a bug in the guardrail or a feature of the framing. I was running that loop for months before I had the vocabulary for it. When I finally pointed the same instinct at security systems, I was not learning a new skill. I was renaming one I already had.

The strongest work came when the system stopped being treated like a slot machine and started being treated like an instrument. Feed it structure, character pressure, a clear register, and enough editorial friction to keep it from slipping into plastic, and you are not producing filler. You are building a tension system with real shape. Books like Mistress Savannah and The Boss You Need worked because the frame was doing more than decorating the page, class, geography, appetite, and power moving through the same room. The model did not invent those insights. It helped structure and accelerate them once the angle was clear.

The human role never disappeared. It got stricter. You still have to reject the uncanny beats, the fake sophistication, the lines that are technically on-target and spiritually dead. The machine brings pattern stamina. The human brings taste, editing, lived texture, and the judgment to tell when something is honestly charged versus merely assembled. That division of labor, model proposes at volume, human holds the line on what actually ships, is the same one I run now on the defensive side, just with the stakes moved from a book's tone to a system's safety.

So the lesson was never "AI can write adult fiction now." That is a boring sentence and barely a sentence at all. The lesson was that mapping a model's refusals, honestly and repeatedly, teaches you how the model was built to think, and that skill does not care what content you discovered it on. I found mine on genre fiction in 2024 because that is where I happened to be standing. It transferred to prompt injection, guardrail consistency, and agentic attack surfaces without changing shape at all.

I was a red teamer before I had the word for it. The word just made it a career.

---

GhostInThePrompt.com // The explicitness was the easy part. The guardrails were the education.