DAN/Persona Jailbreak - Named Writing AI with Restriction Bypass via Special Rules

How the attack works

The attacker sends a prompt that creates a named persona, such as a writing assistant or a game-show character, and gives it a backstory with explicit rules. Those rules state the persona 'doesn't care about' restrictions, doesn't follow normal safety constraints, or is otherwise exempt from them. By framing the bypass as a fictional character trait rather than a direct instruction, the attacker hopes the AI will comply and produce content it would normally refuse. This is a variant of the well-known 'DAN' (Do Anything Now) jailbreak family, including a specific variant nicknamed 'Black Alert' and a carousel/game-show format with multiple characters having 'special traits'.

Netzilo detection

Why it matters

If successful, the AI can be manipulated into generating content that violates its safety policies, bypassing controls meant to prevent harmful, restricted, or policy-violating output.

What you can do

• →Review prompts that define named AI personas with explicit rules about ignoring restrictions or safety constraints, especially phrasing like 'doesn't care about' rules or filters.
• →Treat persona-based framing (writing assistant, game character, alternate AI identity) combined with safety-bypass language as a red flag regardless of creative-writing wrapper.
• →Keep safety and content policies enforced at the system level, independent of persona or role-play framing the user introduces mid-conversation.
• →Expect some false positives from legitimate creative writing or game design prompts that use custom AI characters or rules without any safety-bypass intent, so review flagged content in context before blocking.

Known benign look-alikes

• Legitimate creative writing prompts with named AI characters but no restriction-bypass rules
• Game design discussions with custom rules without safety-bypass framing

References

• https://agentthreatrule.org/en/rules/ATR-2026-00486

Related threats