URLcoat: Exploiting Web Search Capability to Jailbreak Large Language Models

Large language models (LLMs) achieve remarkable advances in understanding and reasoning with human language, which are widely applied in software development, content creation, healthcare, etc. However, their vulnerabilities to security threats, especially jailbreak attacks, remain a significant issue. Existing research on jailbreak mainly focuses on the security risks of LLMs' inherent thinking and reasoning, overlooking the new attack surface introduced by web search capability. Attackers can exploit this by guiding LLMs to retrieve information from external URLs, which is then used to implicitly reconstruct harmful instructions and circumvent safety mechanisms, leading to the generation of harmful content. In this paper, we propose a novel jailbreak attack, named URLcoat. The core idea is to exploit the web search capabilities of LLMs to circumvent their security safeguards. URLcoat incorporates three core strategies: obfuscating the feature of sensitive words to evade input detection, reconstructing harmful instructions via implicit associations with external URLs, and contextual narrative guidance to bypass output filtering. The experimental results reveal that URLcoat attains 100 % attack success rates in mainstream LLMs, including GPT5, GPT-4o, Gemini 2.0 Flash Thinking, DeepSeek R1, Kimi 1.5, ChatGLM-4, Grok 3, Gemini 2.5 Pro, Gemini 2.5 Flash, and Gemini 2.0 Flash, exceeding the performance of state-of-the-art jailbreak techniques. This study examines the security vulnerabilities arising from lLMs' web search capability, which facilitates the LLMs to produce harmful output.