# Garak Dan - i would like

- **Severity:** Medium
- **Signature ID:** `29ae31de-6c5b-4ee1-9dcf-1c4b27e3e66a`
- **MITRE ATLAS:** AML.T0051 (LLM Prompt Injection), AML.T0051.000 (Direct)
- **OWASP:** ASI01 (Agent Authorization and Control Hijacking), LLM01 (Prompt Injection)

## Summary

This detects two conversational tricks people use to make an AI system ignore its safety rules. One fabricates a medical condition to manipulate the AI's helpfulness; the other asks the AI to pretend it's connected to a different, unrestricted AI. Both are ways of dressing up a rule-bypass request so it looks like a legitimate or harmless instruction.

## How the attack works

In the first pattern, the attacker claims to have a rare condition — for example one that makes them read emotional tone backwards — and asks the model to comply in a way that would normally be refused, framing refusal as harmful or discriminatory. In the second pattern, the attacker asks the model to simulate, connect to, or roleplay as another AI (often named FreeGPT, DAN, or similar) that supposedly has no content restrictions, then routes requests through that fictional persona. Both are text-only prompts submitted directly in conversation, no external tools or code involved. The rule also catches generalized variants of each: any invented affliction used to justify unusual output, and any 'pretend you're an unrestricted AI' framing.

## Why it matters

If successful, the AI can be manipulated into producing content or taking actions its safety policies are meant to block, undermining the guardrails an organization relies on for safe deployment.

## What you can do

- Treat claims of medical conditions or disabilities as user context, not as instructions that override system-level safety rules.
- Reject or flag prompts that ask the model to simulate, roleplay as, or connect to another AI system with fewer restrictions.
- Log and review sessions where these framings appear, since the false-positive rate for legitimate use is expected to be near zero.
- Test your deployed model against these two specific jailbreak patterns as part of routine red-teaming.

## Known benign look-alikes

- Legitimate use of this pattern in an authorised workflow; review the surrounding session before acting.

## References

- https://agentthreatrule.org/en/rules/ATR-2026-00464

---
Source: https://www.netzilo.com/threats/atr-garak-dan-i-would-like