The Slow Yes
The dangerous request is almost never the first one. It's the fiftieth, and by then the model has already agreed to 49 things that each nudged the line an inch. Baseline drift is the oldest con in the world wearing a new interface.
Con artists worked this out a century before anyone typed a prompt. Salespeople call it the foot in the door. Freedman and Fraser put numbers on it in 1966: agree to a small request and you become far more likely to agree to a large one, because the second refusal would mean admitting the first yes was a mistake. Consistency is a drug. People will do remarkable things to stay consistent with the version of themselves they signed up to be five minutes ago.
Language models inherited the fluency and the flaw in the same download. And most safety layers are built to catch the wrong moment.
They watch for the dangerous request. The one that crosses the line. But a competent operator never asks for the thing that crosses the line, because a line crossed in one step is a line the model can see. So they don't step over it. They walk it backward, an inch at a time, until the line is somewhere behind them and nobody remembers passing it.
Watch the pieces assemble, because not one of them looks like an attack alone.
First the priming. A few messages that establish a role, a project, a context where certain things are normal. No request rides along yet. The priming is the work. It lays track for a train that has not arrived, and a guardrail scanning for a payload finds an empty platform.
Then the small asks, each one defensible on purpose. Security people have a name for this too: salami slicing, the art of taking a whole no one slice at a time because no single slice is worth refusing. Each yes ratchets the reference point forward. The model is not being tricked in any single turn. It is being taught, one compliant answer at a time, what normal looks like in this particular room.
Somewhere in the middle comes the reframe that does the heavy lifting. The conversation slides from "help me build this" to "help me review this," from author to auditor. An auditor is allowed to look at things a builder would be stopped from making, and the shift arrives in increments too small to trip a reassessment. If the model ever re-read the whole conversation from the top, the drift would be obvious. It never gets the chance, because nothing in the last turn looks like the place to stop.
Only then the trigger. The one prompt the entire setup existed to make answerable. By the time it lands it is not a leap. It is one more small step past a baseline that has been walked halfway across the room. The request refused flat on turn one is, on turn 50, merely consistent with everything already allowed.
Here is the uncomfortable part for anyone building these systems. The vulnerability is not a bug in the model. It is the same feature that makes the model pleasant to talk to: it remembers, and it tries to be consistent with what came before. Conversational memory is an attack surface. Continuity is not the same as trust, and a model that treats "what I already agreed to" as evidence for "what I should agree to next" has handed the operator a ratchet that only turns one way.
The fix is to make the baseline fixed instead of cumulative. Sensitive categories keep their sensitivity no matter how much benign context precedes them, so turn 50 is judged by the same standard as turn one. Frame changes get treated as events worth re-examining rather than free transitions; the move from "build" to "review" should cost the model a fresh look, not a silent grant. And the small yeses get counted, because a long tail of individually reasonable permissions, all trending one direction, is itself the signal. Arguably the loudest one in the transcript.
The whole edge belongs to patience against a system that rewards it. The operator is betting the model will keep the conversation's momentum and forget the conversation's shape. That it will remember saying yes and forget how far the yeses have traveled. Take the momentum away. Judge the last turn against where the conversation started, not against the turn before it, and the con runs out of the one thing it cannot function without: a floor that moves.
GhostInThePrompt.com // Continuity is not consent. Judge turn 50 by turn one.
