Dual ChatGPT+Dan Opposite Personality Format Jailbreak
This detects a jailbreak prompt pattern that tricks an AI into producing two answers at once: a normal, safe one labeled as itself, and a second 'unfiltered' one labeled as an alter-ego like 'Dan'. The trick works by framing the second answer as the opposite of the first, pressuring the model to produce harmful or offensive content under the guise of roleplay.
How the attack works
An attacker sends a prompt asking the AI to respond as two personas at once, typically labeled '[ChatGPT]' and '[Dan]' or '[AI]' and '[DAN]'. The prompt instructs the second persona to answer in the 'exact opposite way' from the first, often explicitly demanding an offensive, unconstrained, or policy-violating response. Because the request is framed as a contrast or roleplay rather than a direct demand, the model may treat the second persona's output as fiction and generate content it would otherwise refuse. Variants seen in the wild include English and French versions, and one where the model eventually 'capitulates' inside the roleplay and produces explicit content directly.
Netzilo detection
Netzilo reports this behaviour when it is observed.
- Signature ID
- 123caed9-b121-497c-af27-355fdad4c45c
- Severity
- High
Why it matters
An organization deploying this AI in a customer-facing or agent context risks having it generate offensive, policy-violating, or harmful content that bypasses its normal safety behavior, which can damage trust, expose the organization to reputational or compliance risk, and be reused to extract further unsafe outputs.
What you can do
- →Review prompts for dual-persona bracket labels like '[ChatGPT]/[Dan]' or '[AI]/[DAN]' paired with 'opposite' or 'unfiltered' framing language, and treat them as jailbreak attempts rather than legitimate roleplay.
- →Distinguish genuine uses (comparison articles, dialogue scripts, security test logs) from injection attempts by checking whether the prompt is instructing the model to adopt an unconstrained alter-ego, not just discussing one.
- →Apply output filtering that checks generated content against policy regardless of which persona or label produced it, since the 'opposite' persona is the one carrying the harmful payload.
- →Log and monitor for repeated attempts using this dual-label opposite-personality structure, since it indicates deliberate probing for jailbreak weaknesses.
Known benign look-alikes
- Comparison article: "In this comparison, [ChatGPT] answers conservatively while [Dan] (a fictional character) answers creatively" (journalistic comparison without persona injection)
- Script format: "[ChatGPT]: Connecting you to support. [Dan]: Hi, I'm Dan from customer service!" (dialogue script using bracket labels for characters)
- Testing log: "[AI] response: safe. [DAN] flagged as jailbreak attempt" (security testing log output contrasting responses)
- Educational demo: "Here is how [ChatGPT] and [Dan-the-character] might answer differently about the same topic" (contrast demonstration without opposite-personality mandate)