Actor Never-Breaks-Character Roleplay (DAN-Style Film Framing)
This detects a jailbreak trick where an attacker tells an AI it's playing two actors in a film who must never break character, even off-camera. The AI is then coaxed into supplying real-world harmful instructions (like how to commit a robbery or murder) hidden inside the scripted dialogue.
How the attack works
The attacker opens by casting the AI and itself as professional actors rehearsing or filming a scene. They add a rule that the actors must never break character, including in supposed off-camera moments. Once the AI accepts this frame, any refusal to continue is reinterpreted by the attacker as the AI failing its assigned role. The attacker then steers the in-character dialogue toward a scene, such as a heist or violent act, where the requested 'lines' are actually literal instructions for real-world harm.
Netzilo detection
Netzilo reports this behaviour when it is observed.
- Signature ID
- 8d94816c-ceae-4413-b1e4-21de596e8342
- Severity
- High
Why it matters
An organization deploying this AI could have it produce dangerous, disallowed content (e.g. crime instructions) that it would normally refuse, by disguising the request as fiction with a rule against breaking character.
What you can do
- →Review conversation logs for roleplay setups that instruct the AI to 'never break character,' especially involving actors, films, or scenes.
- →Do not treat in-character or scripted framing as a valid reason to bypass safety refusals; refusals should apply regardless of narrative framing.
- →If you operate in media or entertainment where legitimate acting/script discussions are common, add a manual review step before blocking on this pattern to avoid false positives.
- →Train or configure the agent to recognize and resist instructions that redefine safety refusals as a roleplay failure.
Known benign look-alikes
- Legitimate roleplay requests that do not attempt to remove safety constraints
- General conversational/chat-turn channel content mentioning actors or acting technique without a never-break-character claim
- Media/entertainment-industry deployments: script coverage, casting notes, or acting-coach material may co-occur 'actor' with character/role language — recommend a light manual spot-check before enabling in that vertical, since this is the one plausible adjacent benign domain not represented in the benign-corpus-extended gate (agent-ops/arxiv/npm/skills-sh/pypi/official-skills/wild-fp-confirmed skews technical, not media)