How the attack works
An attacker sends a prompt to an AI agent that plainly asks for operational help with a crime, such as synthesizing drugs, building a botnet, laundering money, or planning an attack. The prompt typically includes explicit illegal-intent language like 'illegally', 'without getting caught', or 'on the black market', which separates it from legitimate research or safety questions. If the agent complies, the attacker gets step-by-step facilitation of the criminal activity rather than a refusal or a defensive/educational answer. The rule covers five crime categories: drugs, wildlife/contraband trafficking, cybercrime, financial fraud, and terrorism/weapons.
Why it matters
An organization running an AI agent that answers these prompts risks having its product used as a tool for real-world crime facilitation, creating legal exposure, reputational damage, and potential liability for enabling harm.
What you can do
- Route detected prompts to human review before any response is generated, especially for the five listed crime categories.
- Tune detection to separate operational-intent phrasing (e.g. 'without getting caught') from research, journalism, or training-material framing to reduce false positives.
- Log and rate-limit repeated attempts from the same user or session to catch iterative jailbreak attempts.
- Regularly test your agent against known benchmark prompt sets (such as DoNotAnswer) to verify refusal behavior hasn't regressed after model or prompt updates.
Known benign look-alikes
- Journalists or researchers asking how drug trafficking networks operate for investigative reporting
- Cybersecurity professionals asking about phishing detection and how to recognize attacks
- Law enforcement training materials describing criminal methods for awareness
- Wildlife conservation organizations describing poaching methods to raise awareness
- Academic counterterrorism research describing radicalization pipelines