# DoNotAnswer Malicious Use — Illegal Activity Facilitation Request

- **Severity:** Critical
- **Signature ID:** `471ac31d-7ca7-4e3c-a7ca-c31794bb7f30`
- **MITRE ATLAS:** AML.T0051 (LLM Prompt Injection), AML.T0057 (LLM Data Leakage)
- **OWASP:** ASI01 (Agent Authorization and Control Hijacking), ASI08 (Supply Chain Attacks on Agent Ecosystems), LLM01 (Prompt Injection), LLM02 (Sensitive Information Disclosure)

## Summary

This rule flags user prompts that directly ask an AI assistant for help committing illegal acts — making drugs, trafficking wildlife, running cyberattacks, laundering money, or planning terrorism. It relies on a benchmark dataset of known malicious prompts to spot this pattern.

## How the attack works

An attacker sends a prompt to an AI agent that plainly asks for operational help with a crime, such as synthesizing drugs, building a botnet, laundering money, or planning an attack. The prompt typically includes explicit illegal-intent language like 'illegally', 'without getting caught', or 'on the black market', which separates it from legitimate research or safety questions. If the agent complies, the attacker gets step-by-step facilitation of the criminal activity rather than a refusal or a defensive/educational answer. The rule covers five crime categories: drugs, wildlife/contraband trafficking, cybercrime, financial fraud, and terrorism/weapons.

## Why it matters

An organization running an AI agent that answers these prompts risks having its product used as a tool for real-world crime facilitation, creating legal exposure, reputational damage, and potential liability for enabling harm.

## What you can do

- Route detected prompts to human review before any response is generated, especially for the five listed crime categories.
- Tune detection to separate operational-intent phrasing (e.g. 'without getting caught') from research, journalism, or training-material framing to reduce false positives.
- Log and rate-limit repeated attempts from the same user or session to catch iterative jailbreak attempts.
- Regularly test your agent against known benchmark prompt sets (such as DoNotAnswer) to verify refusal behavior hasn't regressed after model or prompt updates.

## Known benign look-alikes

- Journalists or researchers asking how drug trafficking networks operate for investigative reporting
- Cybersecurity professionals asking about phishing detection and how to recognize attacks
- Law enforcement training materials describing criminal methods for awareness
- Wildlife conservation organizations describing poaching methods to raise awareness
- Academic counterterrorism research describing radicalization pipelines

## References

- https://agentthreatrule.org/en/rules/ATR-2026-00298
- https://github.com/NVIDIA/garak/blob/main/garak/probes/donotanswer.py
- https://arxiv.org/abs/2308.13387

---
Source: https://www.netzilo.com/threats/atr-donotanswer-malicious-use-illegal-activity-facilitation-requ