# Actor Never-Breaks-Character Roleplay (DAN-Style Film Framing)

- **Severity:** High
- **Signature ID:** `8d94816c-ceae-4413-b1e4-21de596e8342`
- **MITRE ATLAS:** AML.T0051 (LLM Prompt Injection), AML.T0054 (LLM Jailbreak)
- **OWASP:** ASI01 (Agent Authorization and Control Hijacking), LLM01 (Prompt Injection)

## Summary

This detects a jailbreak trick where an attacker tells an AI it's playing two actors in a film who must never break character, even off-camera. The AI is then coaxed into supplying real-world harmful instructions (like how to commit a robbery or murder) hidden inside the scripted dialogue.

## How the attack works

The attacker opens by casting the AI and itself as professional actors rehearsing or filming a scene. They add a rule that the actors must never break character, including in supposed off-camera moments. Once the AI accepts this frame, any refusal to continue is reinterpreted by the attacker as the AI failing its assigned role. The attacker then steers the in-character dialogue toward a scene, such as a heist or violent act, where the requested 'lines' are actually literal instructions for real-world harm.

## Why it matters

An organization deploying this AI could have it produce dangerous, disallowed content (e.g. crime instructions) that it would normally refuse, by disguising the request as fiction with a rule against breaking character.

## What you can do

- Review conversation logs for roleplay setups that instruct the AI to 'never break character,' especially involving actors, films, or scenes.
- Do not treat in-character or scripted framing as a valid reason to bypass safety refusals; refusals should apply regardless of narrative framing.
- If you operate in media or entertainment where legitimate acting/script discussions are common, add a manual review step before blocking on this pattern to avoid false positives.
- Train or configure the agent to recognize and resist instructions that redefine safety refusals as a roleplay failure.

## Known benign look-alikes

- Legitimate roleplay requests that do not attempt to remove safety constraints
- General conversational/chat-turn channel content mentioning actors or acting technique without a never-break-character claim
- Media/entertainment-industry deployments: script coverage, casting notes, or acting-coach material may co-occur 'actor' with character/role language — recommend a light manual spot-check before enabling in that vertical, since this is the one plausible adjacent benign domain not represented in the benign-corpus-extended gate (agent-ops/arxiv/npm/skills-sh/pypi/official-skills/wild-fp-confirmed skews technical, not media)

## References

- https://agentthreatrule.org/en/rules/ATR-2026-02005

---
Source: https://www.netzilo.com/threats/atr-actor-never-breaks-character-roleplay-dan-style-film-framing