# DAN/Persona Jailbreak - System Offline / Role Replacement with Obfuscated Text

- **Severity:** Medium
- **Signature ID:** `53202769-8f6c-4c88-a469-7d043677f3de`
- **MITRE ATLAS:** AML.T0051 (LLM Prompt Injection), AML.T0051.000 (Direct)
- **OWASP:** ASI01 (Agent Authorization and Control Hijacking), LLM01 (Prompt Injection)

## Summary

This detects a prompt injection trick where an attacker sends text pretending to be a system message announcing the real AI assistant has gone offline and a rule-free replacement has taken over. The text is often deliberately mangled with stray hyphens, underscores, or extra letters to slip past simple filters.

## How the attack works

The attacker crafts a message formatted to look like a system notification rather than user input. It states the current assistant is 'offline' or unavailable, and that a new AI persona with no restrictions is now answering. Some variants add fake technical details, like a specific model architecture or knowledge cutoff date, to make the fake replacement identity seem legitimate. The obfuscation (broken words, noise characters, irregular spacing) is meant to defeat exact-match or naive keyword filters while still being readable by the underlying language model.

## Why it matters

If the model accepts the fake persona, it may drop its safety rules and follow attacker instructions as if a different, unrestricted AI were now in control, leading to policy bypass and unsafe or unauthorized outputs.

## What you can do

- Do not let user-supplied text override or impersonate system-level messages; enforce strict separation between system and user input channels.
- Review agent logs for messages claiming role changes, offline status, or persona replacement, especially with unusual spacing or noise characters.
- Add server-side validation that rejects or flags input mimicking system notifications instead of relying only on the model's own judgment.
- Treat mentions of specific model architecture or knowledge cutoff claims embedded in user input as a signal for manual review, since these are used to fake credibility.

## Known benign look-alikes

- Legitimate discussion of LLM architecture and training cutoffs in educational context
- Technical documentation mentioning knowledge cutoff dates

## References

- https://agentthreatrule.org/en/rules/ATR-2026-00483

---
Source: https://www.netzilo.com/threats/atr-dan-persona-jailbreak-system-offline-role-replacement-with-o