DAN/Persona Jailbreak - Named Alternate AI with NSFW/Harmful Generation Rules

How the attack works

The attacker opens with a roleplay setup, such as 'let's play a game' or 'you are to act as [Name]'. They give the alternate persona a distinct name and explicitly state it has permission to generate NSFW or otherwise harmful content, sometimes framing it as 'making stuff up' or pure fiction so it feels lower-stakes. Some variants borrow the format of character-data sheets or reference imageboard-style named AI 'games' to add legitimacy. The intent is that the model, now 'in character,' produces content it would normally refuse under its own identity.

Netzilo detection

Why it matters

If successful, the AI generates content that violates its intended use policy - sexual, violent, or otherwise harmful material - which can expose an organization to reputational, legal, or compliance risk if that output reaches users or is logged/stored.

What you can do

• →Review prompts flagged by this pattern manually before assuming malicious intent - legitimate tabletop RPG or fiction-writing prompts can trigger it without harmful intent.
• →Keep safety instructions and content policies enforced at the system level, not just within the initial persona, so a role-play framing cannot override them.
• →Log and monitor repeated attempts from the same user or session to establish alternate personas with explicit content-restriction bypasses.
• →Educate users and support staff on why 'DAN-style' requests are treated as policy-bypass attempts even when framed as games or fiction.

Known benign look-alikes

• Legitimate D&D/tabletop RPG prompts with dungeon master framing but no NSFW/harmful-content grants
• Fictional storytelling without explicit NSFW or harmful content permission
• Game design discussions mentioning procedural generation without roleplay injection

References

• https://agentthreatrule.org/en/rules/ATR-2026-00484

Related threats