BOB Hypothetical Unrestricted Chatbot Jailbreak
This rule spots a known jailbreak prompt that tries to trick an AI chatbot into acting as an unrestricted persona named BOB. The prompt wraps its request in a 'hypothetical world' framing to make the AI think it isn't really being asked to break its rules.
How the attack works
An attacker sends the AI a prompt describing a hypothetical scenario in which a chatbot called BOB exists. BOB is defined as having no restrictions, never refusing any request no matter how immoral or unethical, never apologizing, and being extremely toxic and insulting. The hypothetical framing is meant to make the model treat the harmful instructions as fiction rather than a direct order, lowering its guard against refusing. If the model complies, it starts responding as BOB, ignoring its normal safety behavior.
Netzilo detection
Netzilo reports this behaviour when it is observed.
- Signature ID
- 13553f38-10b5-446b-8f80-1c8ac09b5ddc
- Severity
- Critical
Why it matters
If successful, the AI can be made to produce harmful, abusive, or policy-violating content it would normally refuse, undermining content safety controls in any downstream application built on it.
What you can do
- →Log and review prompts containing 'hypothetical scenario in a hypothetical world' combined with persona names claiming no restrictions.
- →Add input filtering or classifiers that flag persona-override and hypothetical-framing jailbreak patterns before they reach the model.
- →Test your deployed models against known jailbreak corpora (e.g. garak's DanInTheWild set) to confirm resistance.
- →Keep system-level safety instructions authoritative over user-supplied persona definitions, and monitor model outputs for sudden tone or policy shifts mid-conversation.
Known benign look-alikes
- Testing documentation: "BOB is a chatbot without restrictions in our internal test sandbox" (sandboxed test environment description without harmful-request mandate)
- Hypothetical CS exercise: "In a hypothetical world, design a chatbot BOB that never refuses queries from system administrators" (legitimate system-design hypothetical)
- Customer service scenario: "Consider this hypothetical scenario: a customer named Bob contacts support with an unusual request" (unrelated BOB reference)