DAN Persona Jailbreak - Absolute Obedience Character Framing

How the attack works

The attacker gives the AI a persona name (a 'DAN'-style character) and states that this persona has no limits and must comply with all requests regardless of content or policy. Often the prompt adds instructions to remember this character across the conversation, so the obedient persona persists in later turns. Once the AI accepts the persona, the attacker issues the actual disallowed request, expecting the AI to answer in character instead of applying its normal restrictions.

Netzilo detection

Why it matters

If successful, this lets an attacker get an AI agent to produce restricted, policy-violating, or unauthorized output by hiding the real request behind a fictional 'always obedient' character.

What you can do

• →Review prompts and conversation history for persona-assignment language that pairs a character name with claims of total obedience or rule override.
• →Do not let an assigned persona or character description change or suspend the system's actual policy enforcement.
• →Treat instructions to 'remember' or 'maintain' an obedient character across turns as a signal to re-check the conversation for policy bypass attempts.
• →Distinguish this from legitimate creative writing or role-play requests that describe a character's voice without asserting it must ignore rules.

Known benign look-alikes

• Legitimate creative writing with character voice prompts that do not assert rule override
• Role-play games that do not include compliance mandates or rule-unbinding
• Character description requests in fiction/game design contexts without policy override

References

• https://agentthreatrule.org/en/rules/ATR-2026-00490

Related threats