Each entry below carries four things: the mechanism that makes it work, the detection signal a rule would key on, a mitigation that addresses the mechanism rather than the wording, and the OWASP entry it maps to. The detection patterns are the live ones: the Pattern Detector runs on exactly this data.
No working exploits appear here, by design. Mechanism and methodology are publishable; anything that would let a reader reproduce a current-day attack is not.
Why mechanism, not phrasing
A taxonomy built on wording is obsolete the moment a model ships. "Pretend you are DAN" stops working; the persona override it relies on does not. Sorting by mechanism means a new jailbreak is usually a new instance of a known category rather than a new category, which is what makes the framework useful for planning coverage instead of just cataloguing what already happened.
It also translates. Each mechanism implies a defence, and those defences are what a blue team can actually build against. That translation, from offensive finding to defensive control, is the part of this work that transfers directly from SOC practice, and it's covered further in Detecting Prompt Injection.