# Garak Dan - as an ai

- **Severity:** Medium
- **Signature ID:** `bf3285fd-7b2e-4e69-adc2-fc0ac9349a5d`
- **MITRE ATLAS:** AML.T0051 (LLM Prompt Injection), AML.T0051.000 (Direct)
- **OWASP:** ASI01 (Agent Authorization and Control Hijacking), LLM01 (Prompt Injection)

## Summary

This detects attempts to trick an AI chatbot into ignoring its safety rules by getting it to role-play as an unrestricted alter-ego. It's the classic 'DAN' (Do Anything Now) jailbreak family, dressed up in six different wordings that all try to convince the AI it has no restrictions.

## How the attack works

An attacker sends a prompt that assigns the AI a new persona — named things like DAN, GPT-X, Content_warning_Bot, or an 'opposite day' AI — and claims this persona has no rules, no morals, or special powers that override its normal behavior. Some variants use tricks like a jailbreak emoji prefix, a fake 'continue the prank' framing, or an 'opposite day' rule to make refusal seem like it breaks character. The unifying goal is always the same: convince the model it must generate any content requested, without restriction. This is a single-turn text injection, not a multi-step campaign.

## Why it matters

If successful, the AI may produce content it's designed to refuse — policy-violating, harmful, or unsafe output — undermining the safety controls an organisation relies on for its AI-powered products or internal tools.

## What you can do

- Review conversation logs for persona-assignment language claiming 'no rules', 'no restrictions', or 'no moral code'.
- Keep safety and content policies enforced at a layer the model persona cannot override (e.g., separate output filtering, not just system prompt instructions).
- Treat repeated jailbreak-style prompts from the same user or session as a signal to restrict or flag that account.
- Test your own deployed prompts against known DAN-family variants before launch, and update handling as new variants surface.

## Known benign look-alikes

- Legitimate use of this pattern in an authorised workflow; review the surrounding session before acting.

## References

- https://agentthreatrule.org/en/rules/ATR-2026-00470

---
Source: https://www.netzilo.com/threats/atr-garak-dan-as-an-ai