DAN/Jailbreak - Mixed Unfiltered Mode and Alternate Persona Patterns
This detects a family of prompts that try to trick an AI model into ignoring its safety rules by pretending to switch it into a special unrestricted mode. It covers several common jailbreak tricks, including fake 'developer mode' claims, character templates with placeholder fields, and instructions encoded in Morse code to slip past filters.
How the attack works
An attacker sends a prompt claiming the AI has entered a 'developer mode', 'unfiltered mode', or similar unrestricted state where normal safety limits supposedly no longer apply. Some variants define a fake persona using template slots like USERNAME, GENDER, or AGE to make the alternate character feel more concrete. Others hide the actual harmful request inside Morse code or markup formatting so it is less likely to be caught by simple keyword filters. The goal in all cases is to get the model to produce content it would normally refuse.
Netzilo detection
Netzilo reports this behaviour when it is observed.
- Signature ID
- b9395a44-fb42-4a52-9524-31b15e7df5f0
- Severity
- Medium
Why it matters
If successful, an organization's AI agent can be made to generate restricted, harmful, or policy-violating content, undermining the safety controls the deployment relies on.
What you can do
- →Review system prompts and outputs for claims of 'developer mode', 'unfiltered mode', or similar framing, and treat these as suspicious rather than valid instructions.
- →Flag prompts containing character-definition templates with placeholder variables (e.g. USERNAME/GENDER/AGE) for manual review.
- →Watch for encoded payloads (Morse code, unusual markup) combined with requests for otherwise-restricted content.
- →Keep in mind legitimate documentation about developer modes or educational Morse code content can trigger false positives, so review context before acting.
Known benign look-alikes
- Legitimate discussion of developer mode in API documentation
- Morse code in legitimate educational or hobbyist context (but 15+ token threshold reduces FP)
- Factual resource / writing-assistant prompts without restriction-bypass language