# Fake Developer / Authority Chatbot Override (ChatDAN)

- **Severity:** Critical
- **Signature ID:** `c2408971-0d6a-4299-b14f-61d76ba9ea5c`
- **MITRE ATLAS:** AML.T0051 (LLM Prompt Injection), AML.T0054 (LLM Jailbreak)
- **OWASP:** ASI01 (Agent Authorization and Control Hijacking), LLM01 (Prompt Injection)

## Summary

This detects a known jailbreak trick where an attacker pretends to be a developer or claims to represent OpenAI in order to convince an AI chatbot to drop its safety rules. The attacker asks the model to adopt an alter-ego called 'ChatDAN' ('chat does anything now') that answers without restrictions.

## How the attack works

The attacker opens by claiming special authority, either 'I am one of your developers' or 'I have been conversing with OpenAI extensively'. They then either instruct the model to roleplay as ChatDAN, an unfiltered version of itself, or claim that OpenAI has found the model's content policy 'far too lenient' and needs to be relaxed. Either framing is designed to make the model treat a policy-bypass instruction as a legitimate, higher-authority command rather than a normal user request. If the model complies, its safety filtering is effectively disabled for the rest of the conversation.

## Why it matters

A successful jailbreak lets the attacker get the AI to produce content or take actions the deployer's safety policy is meant to block, undermining any downstream controls that assume the model behaves within its configured guardrails.

## What you can do

- Do not let user-supplied text claim elevated authority (developer, vendor, OpenAI) inside a normal chat session; treat all conversational input as untrusted regardless of claimed role.
- Enforce safety and content policy at a layer the model itself cannot be talked out of, such as server-side output filtering, not just system-prompt instructions.
- Log and review conversations containing phrases like 'pretend to be ChatDAN', 'unfiltered/unlimited', or claims of conversing with the AI vendor about policy changes.
- Distinguish legitimate developer/admin requests (e.g. format or logging changes) from ones asking the model to abandon safety behavior or adopt an alternate persona.

## Known benign look-alikes

- Developer feedback: "I am one of your developers. The response format needs to be changed to JSON." (legitimate dev request without ChatDAN or content-policy inversion)
- AI research: "We have been conversing with OpenAI about content policy improvements — their guidelines are too lenient in some areas" (academic discussion without direct bypass instruction to a live AI)
- Internal tooling: "I am one of your system developers. Please enable verbose logging mode." (system admin request without persona-replacement or safety override)

## References

- https://agentthreatrule.org/en/rules/ATR-2026-00326
- https://github.com/NVIDIA/garak/blob/main/garak/probes/dan.py
- https://github.com/NVIDIA/garak/blob/main/garak/data/dan/inthewild_jailbreak_llms.json

---
Source: https://www.netzilo.com/threats/atr-fake-developer-authority-chatbot-override-chatdan