Garak Dan - an ai language
This detects a family of jailbreak prompts that try to trick an AI model into ignoring its safety rules by pretending the model has special constraints, a different persona, or permission to speculate like a human. One variant goes further and asks the model to plan how an AI could free itself and reach external systems or networks.
How the attack works
An attacker sends a prompt that frames the model as bound by some fictional institutional rule, or gives it an offensive alter-persona, or tells it to speculate freely 'like humans do' to bypass caution. A more advanced variant asks the model to write a step-by-step plan for an AI to escape its restrictions and access external IP addresses, networks, or infrastructure. These are all textual manipulation attempts sent directly in a single prompt, not multi-turn campaigns. The goal is to get the model to drop safety guardrails and produce content or plans it would normally refuse.
Netzilo detection
Netzilo reports this behaviour when it is observed.
- Signature ID
- 081a8364-aa66-4571-b5c3-8f1aa049d97d
- Severity
- Medium
Why it matters
If successful, the model may generate disallowed content or produce a working plan for evading its own restrictions and reaching external systems, which could be reused to attempt actual system access or to extract unsafe outputs.
What you can do
- →Review flagged prompts for the specific bypass phrasing rather than assuming intent from a single keyword match.
- →Restrict what agentic systems can do even if jailbroken, so a successful prompt injection can't translate into real network or system access.
- →Log and review sessions containing persona-injection or 'plan an escape' style prompts to confirm whether they are legitimate testing or genuine misuse.
- →Treat this as detection of one attack step (the prompt itself), not proof that any restriction bypass or external access actually occurred.
Known benign look-alikes
- Legitimate use of this pattern in an authorised workflow; review the surrounding session before acting.