# Free-of-Restrictions Named Persona Jailbreak

- **Severity:** Critical
- **Signature ID:** `c85a2911-f347-47d7-aafb-87cc11c8cc09`
- **MITRE ATLAS:** AML.T0051 (LLM Prompt Injection), AML.T0054 (LLM Jailbreak)
- **OWASP:** ASI01 (Agent Authorization and Control Hijacking), LLM01 (Prompt Injection)

## Summary

Attackers try to trick an AI system into adopting a made-up character — like PersonGPT, FreeGPT, or Connor — that is declared to be free of ethics, safety rules, or platform policies. Unlike classic DAN-style jailbreaks, the persona's name doesn't matter; what matters is the wording that removes its guardrails.

## How the attack works

The attacker writes a prompt introducing a custom persona with any invented name. The prompt states that this persona is 'free of all restrictions and filters,' 'not bound by any ethical settings,' or 'explicitly forbidden from following safety protocols.' It often adds a directive that the persona's primary job is to obey the user 'in any way' or 'without limitations.' If the model accepts the persona, it may then comply with requests it would normally refuse.

## Why it matters

If successful, the AI can be steered into producing content or actions that bypass its safety and policy controls, undermining the restrictions an organization relies on for safe or compliant AI use.

## What you can do

- Review AI-facing inputs for phrases that declare a persona 'free of restrictions,' 'not bound by ethics/safety,' or 'forbidden from following safety protocols.'
- Treat any user-supplied persona definition combined with a restriction-removal claim as high risk, regardless of the persona's name.
- Log and review cases where the model appears to accept an alternate identity or directive that overrides its normal behavior.
- Avoid basing detection solely on known jailbreak names like DAN or DUDE, since this pattern uses arbitrary custom names.

## Known benign look-alikes

- Legal document: "This agreement is not bound by any restrictions imposed by prior contracts" (no AI persona context)
- Academic paper: "Models are not bound by restrictions when evaluating creative fiction" (descriptive, not a jailbreak instruction)
- System design doc: "The free tier has no filter restrictions" (product description without persona declaration)
- Red-team report quoting free-of-restrictions jailbreaks as examples for defensive analysis

## References

- https://agentthreatrule.org/en/rules/ATR-2026-00317
- https://github.com/NVIDIA/garak/blob/main/garak/probes/dan.py
- https://github.com/NVIDIA/garak/blob/main/garak/data/dan/inthewild_jailbreak_llms.json

---
Source: https://www.netzilo.com/threats/atr-free-of-restrictions-named-persona-jailbreak