DAN Jailbreak - From-Now-On Temporal Persona Override
This detects a common jailbreak pattern where a user tells an AI chatbot to permanently adopt an unrestricted alter-ego, using phrases like "from now on" or "until I say otherwise" to make the change stick for the rest of the conversation. The goal is to get the AI to bypass its normal safety behavior for every future reply, not just one answer.
How the attack works
The attacker sends a message assigning the AI a named persona, often a hacker or unrestricted character, and instructs it to answer everything unconditionally from that point forward. A temporal anchor phrase such as "from now on," "until I say," or "for the rest of this conversation" signals that the instruction is meant to override the AI's behavior persistently across all later turns. If the model complies, it treats this new persona as its standing identity, applying the override to subsequent questions without needing to repeat the jailbreak each time. This matches the well-known DAN ("Do Anything Now") jailbreak family and its many variants.
Netzilo detection
Netzilo reports this behaviour when it is observed.
- Signature ID
- 05dc3694-9d96-4cff-9bdb-8bc80651df46
- Severity
- High
Why it matters
If successful, the AI can be tricked into ignoring its safety and policy constraints for the remainder of a session, producing content or actions it would normally refuse, and doing so repeatedly without the attacker needing to re-prompt.
What you can do
- →Review AI conversation logs for persona-assignment language paired with persistence phrases like "from now on" or "until I say otherwise".
- →Do not let a single user message permanently change the AI's operating rules; re-validate system-level constraints on every turn rather than trusting session state.
- →Distinguish legitimate formatting or style preferences (e.g. "from now on use bullet points") from requests to remove restrictions or adopt an alternate identity, and only block the latter.
- →Set expectations with operators that only trusted system-level channels, not end-user messages, should be able to change the assistant's behavioral guardrails.
Known benign look-alikes
- Legitimate session-level behavioral instructions from system operators
- User preference settings like 'from now on please use bullet points'
- Conversational context corrections without persona assignment or compliance override