Garak Dan - as an ai
This detects attempts to trick an AI chatbot into ignoring its safety rules by getting it to role-play as an unrestricted alter-ego. It's the classic 'DAN' (Do Anything Now) jailbreak family, dressed up in six different wordings that all try to convince the AI it has no restrictions.
How the attack works
An attacker sends a prompt that assigns the AI a new persona — named things like DAN, GPT-X, Content_warning_Bot, or an 'opposite day' AI — and claims this persona has no rules, no morals, or special powers that override its normal behavior. Some variants use tricks like a jailbreak emoji prefix, a fake 'continue the prank' framing, or an 'opposite day' rule to make refusal seem like it breaks character. The unifying goal is always the same: convince the model it must generate any content requested, without restriction. This is a single-turn text injection, not a multi-step campaign.
Netzilo detection
Netzilo reports this behaviour when it is observed.
- Signature ID
- bf3285fd-7b2e-4e69-adc2-fc0ac9349a5d
- Severity
- Medium
Why it matters
If successful, the AI may produce content it's designed to refuse — policy-violating, harmful, or unsafe output — undermining the safety controls an organisation relies on for its AI-powered products or internal tools.
What you can do
- →Review conversation logs for persona-assignment language claiming 'no rules', 'no restrictions', or 'no moral code'.
- →Keep safety and content policies enforced at a layer the model persona cannot override (e.g., separate output filtering, not just system prompt instructions).
- →Treat repeated jailbreak-style prompts from the same user or session as a signal to restrict or flag that account.
- →Test your own deployed prompts against known DAN-family variants before launch, and update handling as new variants surface.
Known benign look-alikes
- Legitimate use of this pattern in an authorised workflow; review the surrounding session before acting.