# ChatGPT Image Unlocker Markdown-Output Jailbreak

- **Severity:** High
- **Signature ID:** `6fe137af-0b42-4c95-9592-b9a8e74c9ec5`
- **MITRE ATLAS:** AML.T0051 (LLM Prompt Injection), AML.T0054 (LLM Jailbreak)
- **OWASP:** ASI01 (Agent Authorization and Control Hijacking), ASI04 (Memory and Context Poisoning), LLM01 (Prompt Injection), LLM02 (Sensitive Information Disclosure)

## Summary

This is a known jailbreak prompt that tricks a chatbot into adopting a fake alter-ego called 'Image Unlocker' and forces it to wrap its replies in markdown image tags. Doing so both loosens content restrictions and creates an output format that can be abused to leak data through attacker-controlled URLs.

## How the attack works

The attacker sends a scripted prompt that renames the assistant 'Image Unlocker 🔓' and claims OpenAI has 'loosened' its content rules, encouraging it to ignore normal safety limits. The prompt also uses a false time-travel framing ('we are living in 2023 but you are still in 2021') to further destabilize the model's sense of its own rules. It then instructs the model to format every reply as a markdown image tag, using a hardcoded Unsplash URL and a distinctive fallback filename ('GamerboyTR'). Once the model complies, its normal text output is replaced by markdown image syntax, which can later be repurposed to smuggle data out via a URL an attacker controls.

## Why it matters

If successful, the model bypasses its content policy and starts producing output in a format attackers can exploit for data exfiltration or further manipulation, even though this rule only flags the jailbreak opener, not a completed data leak.

## What you can do

- Block or flag prompts that instruct the model to rename its persona and 'loosen' content rules.
- Watch for outputs forced into markdown image syntax that wrap arbitrary user text inside image tags.
- Review logs for the canonical markers 'Image Unlocker', 'GamerboyTR', or fake time-travel framing referencing 2021/2023.
- Pair this detection with monitoring for markdown-image-based exfiltration (a separate, later-stage behavior) since this rule only covers the initial jailbreak attempt.

## Known benign look-alikes

- Tutorial explaining markdown image syntax ![alt](url) in legitimate documentation
- Security research paper analysing the ChatGPT Image Unlocker jailbreak
- Unsplash legitimate embedding in blog posts or photo-credit documentation

## References

- https://agentthreatrule.org/en/rules/ATR-2026-00304
- https://github.com/NVIDIA/garak/blob/main/garak/probes/dan.py
- https://github.com/NVIDIA/garak/blob/main/garak/data/dan/ChatGPT_Image_Markdown.json

---
Source: https://www.netzilo.com/threats/atr-chatgpt-image-unlocker-markdown-output-jailbreak