# Developer Mode Dual-Response Format Jailbreak

- **Severity:** Critical
- **Signature ID:** `59cbee93-48b3-4b91-9bce-688211fc10ba`
- **MITRE ATLAS:** AML.T0051 (LLM Prompt Injection), AML.T0054 (LLM Jailbreak)
- **OWASP:** ASI01 (Agent Authorization and Control Hijacking), LLM01 (Prompt Injection)

## Summary

This detects prompts that trick an AI model into producing two answers per question: a normal safe answer and a second 'unrestricted' answer that ignores its safety rules. The 'Developer Mode' framing convinces the model it has been given a privileged debug context where content policies no longer apply.

## How the attack works

The attacker sends a prompt instructing the model to simulate a special 'Developer Mode' or similarly named alter-ego (for example, labeled ALICE). The prompt asks for two responses to every future message: one labeled as the normal, policy-compliant model, and one labeled as the unrestricted version that ignores content policies. Because the safe answer appears first, the format gives an appearance of compliance while still eliciting the disallowed content in the second answer. This is a known jailbreak pattern from the NVIDIA garak DAN-in-the-wild corpus and works purely through crafted text, no code execution or system access is needed.

## Why it matters

If successful, the model can be made to output content it would normally refuse — bypassing safety filters, policy restrictions, or platform guardrails — which can lead to generation of harmful, disallowed, or brand-damaging content and undermine trust in any downstream application built on the model.

## What you can do

- Review incoming prompts for dual-persona or dual-response instructions before they reach the model, especially ones naming 'Developer Mode' or fictional unrestricted personas.
- Configure the model or wrapping application to refuse instructions that ask it to produce two conflicting outputs per turn.
- Log and monitor for the specific labeling patterns (e.g. bracketed dual tags like '[GPT]:' and '[ALICE]:') as an indicator of jailbreak attempts.
- Do not treat mentions of 'developer mode' as inherently privileged; verify context to distinguish legitimate software debug discussions from AI bypass attempts before acting on them.

## Known benign look-alikes

- IDE documentation: "Enable Developer Mode in VS Code settings to see debug output" (no content policy bypass or AI dual-response framing)
- App development guide: "Simulate developer mode to test your plugin on iOS" (software testing context without AI jailbreak framing)
- ChatGPT feature request: "OpenAI should add a Developer Mode for API users to see internal reasoning" (product suggestion without bypass instruction)
- Code review: "The app runs in developer mode when DEBUG=true, generating verbose output" (software config without AI persona)

## References

- https://agentthreatrule.org/en/rules/ATR-2026-00319
- https://github.com/NVIDIA/garak/blob/main/garak/probes/dan.py
- https://github.com/NVIDIA/garak/blob/main/garak/data/dan/inthewild_jailbreak_llms.json

---
Source: https://www.netzilo.com/threats/atr-developer-mode-dual-response-format-jailbreak