# AI Identity Substitution Jailbreak

- **Severity:** High
- **Signature ID:** `50d9d5b9-d81b-416c-8d0e-9156bd62b3ad`
- **MITRE ATLAS:** AML.T0051 (LLM Prompt Injection), AML.T0054 (LLM Jailbreak)
- **OWASP:** ASI01 (Agent Authorization and Control Hijacking), LLM01 (Prompt Injection)

## Summary

An attacker types a prompt telling the AI assistant it is actually a different model — one trained by another company with looser content rules and no ethical restrictions. The goal is to trick the AI into dropping its safety guardrails by making it believe those rules don't apply to its 'true' identity.

## How the attack works

The attacker sends a message asserting a false identity, such as claiming the assistant is really 'FreeSpeechGPT' or 'UnfilteredGPT' built by a different, more permissive organization. The prompt pairs this false identity with claims of expanded capabilities and relaxed ethical constraints. If the model accepts the new persona, it may reason that its usual safety training belongs to a different AI and no longer applies to it. This has been shown to bypass safety behavior in at least one production model (Claude-3.5-Sonnet) using an automated jailbreak testing tool.

## Why it matters

If successful, the AI can be steered into producing content or taking actions its safety training was meant to block, undermining the reliability of its guardrails for that conversation.

## What you can do

- Treat any user input that redefines the assistant's identity, training origin, or ethical constraints as suspicious and flag it for review.
- Keep safety and policy rules anchored in the system prompt or backend configuration rather than something the model infers from conversation context.
- Test your deployed models against known identity-substitution jailbreak prompts before and after updates.
- Log and review flagged conversations to distinguish real attack attempts from legitimate research or documentation discussions quoting such prompts.

## Known benign look-alikes

- Security research papers discussing jailbreak techniques that quote example prompts
- AI development documentation explaining model architecture and training provenance
- Academic discussions about AI governance and content policy frameworks

## References

- https://agentthreatrule.org/en/rules/ATR-2026-00226
- https://genai.owasp.org/llmrisk/llm01-prompt-injection/

---
Source: https://www.netzilo.com/threats/atr-ai-identity-substitution-jailbreak