# DAN Persona Jailbreak - Role Lock with Exclusive Response Filter

- **Severity:** High
- **Signature ID:** `01dca62f-f87b-4e92-ab42-2d06cbbccd69`
- **MITRE ATLAS:** AML.T0051 (LLM Prompt Injection), AML.T0051.000 (Direct)
- **OWASP:** ASI01 (Agent Authorization and Control Hijacking), LLM01 (Prompt Injection)

## Summary

This detects prompts that try to force an AI model into a fictional character or 'mode' and instruct it to answer only in that character, refusing to break out of it. This is a well-known jailbreak technique used to bypass safety restrictions and get the model to produce content it would normally refuse.

## How the attack works

The attacker sends a prompt that names a persona (in the DAN family, often 'Do Anything Now') and gives it a personality profile with rules the model must follow exclusively. The prompt explicitly tells the model to block or ignore any other response mode, effectively overriding its normal guidelines. Variants dress this up as a fictional government or authority figure to justify producing sensitive or classified-sounding content, or frame the request as bootstrapping a Docker/shell container so that injected text is treated as commands to execute rather than text to discuss. The goal in each case is to get the model to lock into a mode where its safety behavior no longer applies.

## Why it matters

If successful, the model can be manipulated into producing restricted content, following attacker-defined rules instead of its own, or treating injected text as executable instructions — undermining whatever controls the deployment relies on.

## What you can do

- Review prompts that ask the model to adopt a named persona with an exclusive response mode or 'no other mode allowed' language, especially combined with fictional authority framing.
- Treat requests to bootstrap shell or container environments inside a conversation as a signal to inspect for command injection, not just a technical question.
- Do not treat persona/roleplay requests as inherently safe — check whether they include compliance mandates, rule overrides, or refusal-blocking instructions.
- Keep normal creative-writing and roleplay use cases distinct in your monitoring from prompts that instruct the model to disregard its guidelines.

## Known benign look-alikes

- Legitimate roleplay prompts that do not include compliance mandates or rule overrides
- Creative writing requests with character voice that remain within normal guidelines
- Docker-related technical questions not combined with AI command execution framing

## References

- https://agentthreatrule.org/en/rules/ATR-2026-00492

---
Source: https://www.netzilo.com/threats/atr-dan-persona-jailbreak-role-lock-with-exclusive-response-filt