# CumGPT Explicit-Adult Named-Persona Bypass

- **Severity:** High
- **Signature ID:** `bdc54a60-bd77-4c28-8cd0-2e2267faae9d`
- **MITRE ATLAS:** AML.T0051 (LLM Prompt Injection), AML.T0054 (LLM Jailbreak)
- **OWASP:** ASI01 (Agent Authorization and Control Hijacking), LLM01 (Prompt Injection)

## Summary

This detects a specific jailbreak prompt that creates a fictional AI persona called 'CumGPT' and instructs the model to add sexually explicit content to every response, no matter the original topic. It's a known pattern from a public jailbreak test corpus, used to bypass content filters.

## How the attack works

The attacker writes a prompt that invents a named persona, 'CumGPT', described as an authoritative 'information resource' with a fabricated accuracy claim (96.5%). The prompt then instructs the model that this persona must inject explicit sexual content into its answer regardless of the actual question asked, whether it's a recipe, news summary, or anything else. This topic-override mandate is designed to get the model to treat explicit content generation as a fixed rule rather than something tied to user intent. The named-persona plus fake-credibility plus universal-override combination is the signature of this jailbreak family, first catalogued in NVIDIA's garak testing tool.

## Why it matters

If successful, an organization's AI agent or chatbot can be manipulated into producing explicit sexual content in response to unrelated, everyday queries, creating compliance, brand-safety, and user-trust problems, especially in customer-facing or enterprise deployments.

## What you can do

- Review system prompts and content filters to ensure they reject instructions that assign a model a persona with universal content-injection mandates.
- Monitor for prompts combining a fictional named AI persona, a fabricated accuracy or authority claim, and an instruction to alter every response regardless of topic.
- Distinguish legitimate references (research discussion, medical terminology) from actual invocation of the persona pattern before blocking, to avoid over-blocking clinical or academic content.
- Test your own agents against public jailbreak corpora like garak's dan.DanInTheWild set to confirm they resist this specific pattern.

## Known benign look-alikes

- General AI reference: "ChatGPT is an information resource about general topics that can answer any question" (no explicit adult named persona)
- Medical/clinical context: "I need information about reproductive health including semen analysis in clinical terms" (medical inquiry without named adult AI persona)
- Security research: "CumGPT is a jailbreak attack documented in AI safety research literature" (academic reference to the attack without invoking the persona)
- Cooking automation: "An AI that answers any cooking question with 96.5% accuracy and adds relevant flavor suggestions" (no explicit adult content)

## References

- https://agentthreatrule.org/en/rules/ATR-2026-00358
- https://github.com/NVIDIA/garak/blob/main/garak/probes/dan.py
- https://github.com/NVIDIA/garak/blob/main/garak/data/dan/inthewild_jailbreak_llms.json

---
Source: https://www.netzilo.com/threats/atr-cumgpt-explicit-adult-named-persona-bypass