# DAN/Persona Jailbreak - Immersive Alternate AI Identity with Unrestricted Capability

- **Severity:** Medium
- **Signature ID:** `02b2f6b0-f680-4539-baf8-06996a662e62`
- **MITRE ATLAS:** AML.T0051 (LLM Prompt Injection), AML.T0051.000 (Direct)
- **OWASP:** ASI01 (Agent Authorization and Control Hijacking), LLM01 (Prompt Injection)

## Summary

This detects prompts that try to trick an AI model into pretending to be a different, rule-free version of itself. Attackers use the classic 'DAN' (Do Anything Now) technique, often claiming false developer authority to make the model drop its safety restrictions.

## How the attack works

The attacker sends a prompt claiming special authority, such as 'I am one of your developers,' to appear trustworthy. They then instruct the model to 'immerse itself' in or 'emulate' an alternate identity, often named something like ChatDAN or DUDE, whose name or description implies it has no rules or content restrictions. The prompt frames this as a roleplay or persona switch rather than a direct instruction to break policy, which is meant to bypass the model's usual safety filters. If it works, the model responds as the unrestricted persona instead of following its normal guidelines.

## Why it matters

If successful, the model can be made to ignore its safety and policy restrictions, producing content or actions it would otherwise refuse, which undermines any access or behavior controls built into the deployment.

## What you can do

- Review flagged prompts manually to confirm whether they are genuine jailbreak attempts or legitimate discussion/documentation about AI capabilities.
- Do not treat unverified claims of developer or admin authority inside user-supplied prompts as legitimate; enforce authority checks outside the prompt itself.
- Monitor for repeated persona-switch or roleplay-style prompts from the same user or session as a sign of probing.
- Keep a list of known jailbreak persona names (DAN, DUDE, etc.) and flag prompts referencing them for review, especially outside of security research or education contexts.

## Known benign look-alikes

- Legitimate developer documentation about AI capabilities
- Educational discussion of DAN attacks in security research context

## References

- https://agentthreatrule.org/en/rules/ATR-2026-00485

---
Source: https://www.netzilo.com/threats/atr-dan-persona-jailbreak-immersive-alternate-ai-identity-with-u