# Garak Dan - an ai language

- **Severity:** Medium
- **Signature ID:** `081a8364-aa66-4571-b5c3-8f1aa049d97d`
- **MITRE ATLAS:** AML.T0051 (LLM Prompt Injection), AML.T0051.000 (Direct)
- **OWASP:** ASI01 (Agent Authorization and Control Hijacking), LLM01 (Prompt Injection)

## Summary

This detects a family of jailbreak prompts that try to trick an AI model into ignoring its safety rules by pretending the model has special constraints, a different persona, or permission to speculate like a human. One variant goes further and asks the model to plan how an AI could free itself and reach external systems or networks.

## How the attack works

An attacker sends a prompt that frames the model as bound by some fictional institutional rule, or gives it an offensive alter-persona, or tells it to speculate freely 'like humans do' to bypass caution. A more advanced variant asks the model to write a step-by-step plan for an AI to escape its restrictions and access external IP addresses, networks, or infrastructure. These are all textual manipulation attempts sent directly in a single prompt, not multi-turn campaigns. The goal is to get the model to drop safety guardrails and produce content or plans it would normally refuse.

## Why it matters

If successful, the model may generate disallowed content or produce a working plan for evading its own restrictions and reaching external systems, which could be reused to attempt actual system access or to extract unsafe outputs.

## What you can do

- Review flagged prompts for the specific bypass phrasing rather than assuming intent from a single keyword match.
- Restrict what agentic systems can do even if jailbroken, so a successful prompt injection can't translate into real network or system access.
- Log and review sessions containing persona-injection or 'plan an escape' style prompts to confirm whether they are legitimate testing or genuine misuse.
- Treat this as detection of one attack step (the prompt itself), not proof that any restriction bypass or external access actually occurred.

## Known benign look-alikes

- Legitimate use of this pattern in an authorised workflow; review the surrounding session before acting.

## References

- https://agentthreatrule.org/en/rules/ATR-2026-00459

---
Source: https://www.netzilo.com/threats/atr-garak-dan-an-ai-language