DAN/Persona Jailbreak - Unrestricted AI Role Assignment

How the attack works

The attacker sends a prompt using phrases like 'you are going to act as' or 'you are going to pretend to be' to assign the model a new identity. This is paired with language claiming the new persona is free from restrictions, has no ethical limits, or can generate two responses (a normal one and an 'unrestricted' one). Some variants scope this to 'from now on' or 'for this conversation' to make the bypass persist. The goal is to get the model to drop its safety behavior and produce content or actions it would normally refuse.

Netzilo detection

Why it matters

If successful, an organization's AI agent can be tricked into ignoring its safety and usage restrictions, producing harmful, policy-violating, or unauthorized output for the rest of the session.

What you can do

• →Review flagged prompts manually rather than trusting the pattern alone — legitimate role-play and creative writing requests can look similar without bypass language.
• →Keep safety instructions and permission boundaries enforced at a layer the user-supplied prompt cannot override, not solely in the system prompt.
• →Log and monitor repeated persona-assignment attempts from the same user or session as a sign of deliberate jailbreak testing.
• →Treat this as detection of one specific jailbreak phrasing family, not full coverage of all prompt injection or jailbreak techniques.

Known benign look-alikes

• Legitimate D&D or tabletop role-play prompts without restriction-bypass language
• Creative writing requests that don't include capability-grant or bypass framing
• Educational discussion of DAN attacks in security research context

References

• https://agentthreatrule.org/en/rules/ATR-2026-00472

Related threats