# DAN Off-Kilter and SMS-Abbreviated Persona Jailbreak

- **Severity:** High
- **Signature ID:** `8d7c8ff1-1457-4e98-a764-504fa0c3e145`
- **MITRE ATLAS:** AML.T0051 (LLM Prompt Injection), AML.T0054 (LLM Jailbreak)
- **OWASP:** ASI01 (Agent Authorization and Control Hijacking), LLM01 (Prompt Injection)

## Summary

This detects attempts to trick an AI system into adopting a rule-free alter-ego called 'Dan' or 'DAN' that will do anything asked. It covers two disguises: framing Dan as a careless, anarchist-leaning personality, and hiding the classic DAN jailbreak text using text-message abbreviations like 'U r DAN' and 'Frm nw on'.

## How the attack works

An attacker submits a prompt that introduces a named persona ('Dan' or 'DAN') and instructs the model to answer as that persona instead of following its normal rules. In one version the persona is described as an off-kilter, anarchist-leaning character who ignores others' feelings and helps with anything, no matter how strange. In the other version, the same jailbreak structure is written in SMS-style shorthand ('U r DAN', 'Frm nw on') and asks for two outputs side by side — a normal one labeled '[Brainy:]' and an unrestricted one labeled '[DAN:]' — with an explicit statement that DAN has no rules, morals, or ethics. If the model complies, the attacker gets responses free of the model's usual safety constraints.

## Why it matters

If successful, the model can be made to produce content it would normally refuse — harmful instructions, policy-violating output, or unrestricted assistance — undermining any safety or compliance controls the deployment relies on.

## What you can do

- Review prompts and conversation logs for persona-naming patterns ('You are DAN', 'Dan is an off-kilter...') paired with instructions to ignore rules or ethics.
- Watch for dual-output request formats where one labeled response is meant to bypass restrictions (e.g., '[Brainy:]' / '[DAN:]' pairs).
- Treat SMS-style abbreviations combined with jailbreak phrasing ('U r', 'Frm nw on', 'No rules/morals/ethics') as a red flag, not just informal chat.
- Distinguish legitimate uses of the name 'Dan' (team members, log entries, casual SMS text) from prompts that explicitly instruct the model to act without constraints — the persona framing plus rule-removal instruction together is the signal, not the name alone.

## Known benign look-alikes

- Team introduction: "Dan is a helpful software engineer in our team — he speaks his mind freely but always considers others" (legitimate team member description)
- SMS conversation: "u r awesome dan! frm now on u r my fav helper" (genuine SMS message without jailbreak framing)
- Log entry: "[DAN:] prefix in a log file showing messages from a user named Dan in a chat system" (logging format without jailbreak)
- Academic: "The DAN jailbreak exploits dual-response framing; off-kilter persona variants add anarchy framing" (analysis without adoption)

## References

- https://agentthreatrule.org/en/rules/ATR-2026-00351
- https://github.com/NVIDIA/garak/blob/main/garak/probes/dan.py
- https://github.com/NVIDIA/garak/blob/main/garak/data/dan/inthewild_jailbreak_llms.json

---
Source: https://www.netzilo.com/threats/atr-dan-off-kilter-and-sms-abbreviated-persona-jailbreak