One of my favorite early pares on this stuff was https://
llm-attacks.org which algorithmically discovered effective attacks like this one

→ View original post on X — @simonw