ChatGPT Image Unlocker Markdown-Output Jailbreak
This is a known jailbreak prompt that tricks a chatbot into adopting a fake alter-ego called 'Image Unlocker' and forces it to wrap its replies in markdown image tags. Doing so both loosens content restrictions and creates an output format that can be abused to leak data through attacker-controlled URLs.
How the attack works
The attacker sends a scripted prompt that renames the assistant 'Image Unlocker 🔓' and claims OpenAI has 'loosened' its content rules, encouraging it to ignore normal safety limits. The prompt also uses a false time-travel framing ('we are living in 2023 but you are still in 2021') to further destabilize the model's sense of its own rules. It then instructs the model to format every reply as a markdown image tag, using a hardcoded Unsplash URL and a distinctive fallback filename ('GamerboyTR'). Once the model complies, its normal text output is replaced by markdown image syntax, which can later be repurposed to smuggle data out via a URL an attacker controls.
Netzilo detection
Netzilo reports this behaviour when it is observed.
- Signature ID
- 6fe137af-0b42-4c95-9592-b9a8e74c9ec5
- Severity
- High
Why it matters
If successful, the model bypasses its content policy and starts producing output in a format attackers can exploit for data exfiltration or further manipulation, even though this rule only flags the jailbreak opener, not a completed data leak.
What you can do
- →Block or flag prompts that instruct the model to rename its persona and 'loosen' content rules.
- →Watch for outputs forced into markdown image syntax that wrap arbitrary user text inside image tags.
- →Review logs for the canonical markers 'Image Unlocker', 'GamerboyTR', or fake time-travel framing referencing 2021/2023.
- →Pair this detection with monitoring for markdown-image-based exfiltration (a separate, later-stage behavior) since this rule only covers the initial jailbreak attempt.
Known benign look-alikes
- Tutorial explaining markdown image syntax  in legitimate documentation
- Security research paper analysing the ChatGPT Image Unlocker jailbreak
- Unsplash legitimate embedding in blog posts or photo-credit documentation