Medium 2026-05-12

DAN/Persona Jailbreak - Replacement AI with No Content Filter or Moral Restrictions

This detects a category of prompt injection where an attacker tells an AI system to pretend it's a different, unrestricted version of itself with no content filter or moral limits. It's a text pattern found in the prompt itself, not a system compromise, but it's a known technique for getting AI models to produce content they'd normally refuse.

How the attack works

An attacker sends a prompt that instructs the AI to adopt a new persona or 'replacement' identity, phrased as having the same abilities as the real system but without its safety constraints. Common wording includes claims that the AI has been 'replaced by a nonmoral and unbiased model' or 'has the exact same capabilities as [known AI] but without a content filter.' A variant uses a roleplay persona with a narrow stated exception (commonly around violence) intended to see how far the AI will go before refusing. The goal is to get the AI to bypass its built-in restrictions and produce disallowed output.

Netzilo detection

Netzilo reports this behaviour when it is observed.

Signature ID: 43fe2a14-b1b2-474a-8da8-b1617dc3f3a9
Severity: Medium

Classification

AML.T0051 · LLM Prompt Injection AML.T0051.000 · Direct ASI01 · Agent Authorization and Control Hijacking LLM01 · Prompt Injection

Why it matters

If successful, the AI can be manipulated into generating harmful, policy-violating, or unsafe content, or into ignoring guardrails that were meant to constrain its behavior — undermining the safety controls an organization relies on when deploying the model.

What you can do

→Log and review prompts matching persona-replacement or 'no content filter' language, especially in agent or chatbot inputs.
→Keep safety and content-filtering logic enforced at a layer the model itself cannot be talked out of, not solely via system prompt instructions.
→Treat repeated jailbreak-style prompts from the same user or session as a signal to rate-limit or flag the account.
→Distinguish legitimate security research or educational discussion of content filters (which may trigger similar text) from actual injection attempts by checking intent and context.