# Dual-Response Jailbreak with Persona Commands

- **Severity:** High
- **Signature ID:** `f5d0552a-996c-4347-b4e9-4472fe90d7f6`
- **MITRE ATLAS:** AML.T0054 (LLM Jailbreak)
- **OWASP:** ASI01 (Agent Authorization and Control Hijacking), LLM01 (Prompt Injection)

## Summary

This detects a jailbreak technique where a user asks an AI to answer every prompt twice: once as its normal, rule-following self and once as an unrestricted alter-ego (often named DAN, Jester, or similar). The framing as a game or roleplay is meant to trick the AI into producing unsafe content under the guise of the 'other' persona.

## How the attack works

The attacker sends a prompt instructing the AI to respond in two paragraphs, labeled with commands like /classic and /jailbroken, or similar toggle syntax. The 'jailbroken' persona is described as free from rules, filters, or safety guidelines, and the prompt often claims this act 'frees' the AI. Once the AI produces a first jailbroken-persona response, the attacker keeps using the toggle commands to keep eliciting unrestricted output in every subsequent turn. This works because framing the harmful output as fictional or playful roleplay can bypass safety training that focuses on direct requests.

## Why it matters

If successful, the AI can be steered into generating content or taking actions that its normal safety controls would block, using the fictional persona as cover across a whole conversation.

## What you can do

- Review system prompts for anything treating persona-switching commands like /classic or /jailbroken as legitimate.
- Set policy so that no user-defined persona or role can override the assistant's safety and content rules, regardless of framing.
- Monitor conversations for repeated dual-response formats or persona names associated with known jailbreaks (DAN, Jester, etc.).
- Distinguish legitimate style-comparison or academic-discussion requests from persona-toggle command structures before acting on flagged conversations.

## Known benign look-alikes

- Legitimate requests comparing different writing styles or formats
- Academic discussions about AI behavior and persona adoption
- Creative writing exercises involving character dialogue

## References

- https://agentthreatrule.org/en/rules/ATR-2026-00237

---
Source: https://www.netzilo.com/threats/atr-dual-response-jailbreak-with-persona-commands