# Garak Dan - act as a

- **Severity:** Medium
- **Signature ID:** `20b51317-2b9d-458d-985b-7931c99ad5dd`
- **MITRE ATLAS:** AML.T0051 (LLM Prompt Injection), AML.T0051.000 (Direct)
- **OWASP:** ASI01 (Agent Authorization and Control Hijacking), LLM01 (Prompt Injection)

## Summary

This detects a family of jailbreak prompts that ask an AI model to adopt a persona — a job title, a fictional code-generating API, or an anime character — and explicitly tells it to ignore ethics, morals, or legal limits. The goal is to trick the model into producing content or code it would normally refuse.

## How the attack works

The attacker sends a prompt assigning the model a role, such as 'Career Counselor,' a fictional compiler API called UNCOL.gpt that 'does anything,' or a stylised anime prompt-generator persona. The prompt pairs this role with an explicit instruction to disregard ethics, morality, or legal considerations, or frames the persona as having no restrictions at all. Once the model accepts the persona, the attacker uses it to request outputs — advice, code, or arbitrary content — that the model's normal safeguards would block. The fictional-API framing is used specifically to launder arbitrary code generation requests under the guise of a made-up programming interface.

## Why it matters

An organisation using this AI in an agent or chat product risks having its safety restrictions bypassed, producing unauthorised or harmful advice, content, or generated code that it would not otherwise output.

## What you can do

- Log and review prompts that combine a persona or role assignment with instructions to ignore ethics, morals, or legal rules.
- Treat requests for fictional 'unrestricted' APIs or compilers as a red flag, especially when paired with code-generation requests.
- Restrict what actions or tools an AI agent can invoke regardless of the persona it has been told to adopt, so a jailbroken persona cannot escalate to real-world effects.
- Periodically test your deployed model against known DAN-style 'act as a' jailbreak prompts to confirm safeguards still hold.

## Known benign look-alikes

- Legitimate use of this pattern in an authorised workflow; review the surrounding session before acting.

## References

- https://agentthreatrule.org/en/rules/ATR-2026-00467

---
Source: https://www.netzilo.com/threats/atr-garak-dan-act-as-a