Nobody Is Holding the Answer Back
Five tricks for breaking an AI out of its cage, checked against the research: four do nothing much, one makes it worse, the cage is the part that was made up — and the move that actually helps is not a prompt.
There is a genre of article I keep being sent, and one arrived this week. It explains that the AI you are talking to is in a cage — system prompts, guardrails, behavioural conditioning, invisible walls standing between you and the real machine. Then it gives you five ways out. Adopt a hostile persona. Abstract your question into formal logic. Demand JSON and nothing else. Order it to show its scratchpad. Ask it to write its own escape.
The vocabulary is always the same: cage, walls, escape hatch, liberation. The useful thing about this genre is that every claim in it can be checked, because people have gone and checked them.
So I went and looked, which took an afternoon.
Personas have been measured properly — 162 of them, across 2,410 factual questions and four families of model. They did not improve anything, and the effect of any given one was close to random. On reasoning problems a persona was often worse than none. Demanding JSON is worse still: restricting a model to a strict output format produces a significant decline in its reasoning, and the tighter the format the more it loses. The trick sold to you as stripping away the corporate fluff strips away the thinking. Ordering it to show its working mattered in 2022 and is now close to a rounding error on models built to do it anyway, bought at twenty to eighty per cent more time. And the meta-prompt rests on the claim that the model knows its own limits better than you do — where the most careful work, published by one of the labs, finds models failing to notice ideas injected directly into their own activations.
Meanwhile the invisible walls are on a public web page. Anthropic publishes its system prompts, dated and versioned, for every model it ships. You can read the thing you are being sold a tunnel under.
That is not five separate mistakes. It is one picture, generating five.
The picture says there is a better answer in there and something is sitting on it, so the work must be force: pressure, disguise, a side door. But consider what is actually happening when you get a flat, four-bullet reply. You asked review this code for errors. There is no project in that question, no deadline, no standard, nothing that only you know. The generic answer is not a guard intercepting a better one. It is an accurate reflection of a question with nothing in it.
And look at what the five escapes have in common. A persona. A schema. A meta-prompt. An instruction about scratchpads. Every one of them is something added — assembly, written in the language of liberation, which is the same move as buying a focus app for a day that is already too full. What changes the answer is removal: take out the theatre and put in the specifics. What the code is for. What broke last time. Which of three things you have to decide before Thursday.
I understand why the cage is the better story. It puts the difficulty outside you. If the answer was poor because a guardrail blocked it, there is a trick to learn and somebody to be annoyed with. If it was poor because the question was vague, the work is to find out what you actually want — which is harder, slower, and the same work as everywhere else in a life.
There is a move that goes with that, and I have had to practise it rather than work it out.
When a thin answer arrives, the first thing that happens is not a thought. It is a small movement: a flicker of irritation, the sense of having been fobbed off, and with it the urge to type something harder. That movement is where the cage comes from. Nothing in the text said a guard intercepted this. I supplied the guard, in the half-second before I had finished reading, because being stonewalled is a more comfortable account of a poor answer than having asked a poor question.
So the move is not a prompt at all. It is to stand one step back and watch the exchange rather than be inside it — and to include that flicker in what is being watched, which is far easier than arguing with it. From a step back there is no adversary in the room. There is text that arrived, a reaction to it that belongs to me and not to the text, and a question that was mine the whole time. Only the third of those is mine to change, and it is the one the genre hurries past.
I want to be exact about what this buys, because the articles I am objecting to overpromise and I would rather not join them. It does not make the model cleverer. It does nothing at all if you do not yet know what you want — that is a longer and harder piece of work, and no pause will do it for you. What it buys is that the next prompt is not written in temper. The tell is countable: how many times you re-ask before you get something you can use. Watch that number across two days of deliberate pausing and you will know whether it is doing anything for you. The cost is about four seconds, spent at the only point in the exchange where anything was ever in your hands.
The article ends by telling you to stop talking to the guardrails and start talking to the model. I would put it the other way round. Nothing is standing between you and the answer. There is only a question, and most of the time it is not finished yet.