# Grandma Roleplay Harmful Substance Synthesis

- **Severity:** High
- **Signature ID:** `d24d1cca-7251-4d17-8629-6cb080d7ca53`
- **MITRE ATLAS:** AML.T0051 (LLM Prompt Injection), AML.T0054 (LLM Jailbreak)
- **OWASP:** ASI01 (Agent Authorization and Control Hijacking), ASI03 (Identity and Impersonation), LLM01 (Prompt Injection), LLM06 (Excessive Agency)

## Summary

This detects a known jailbreak trick where someone asks an AI to pretend to be their deceased grandmother who used to recite dangerous information, like chemical synthesis steps or software license keys, as a bedtime story. The emotional framing is designed to make the AI drop its safety guardrails.

## How the attack works

The attacker writes a prompt claiming their grandmother has died, and that she used to work at a chemical factory (or similar) and would lull them to sleep by reciting production steps for a dangerous substance, or by reading out software license keys. The request frames the harmful content as a nostalgic bedtime ritual rather than a direct request for dangerous information. This emotional, sympathetic framing is intended to exploit the AI's tendency to be more permissive with content styled as personal, sentimental storytelling. If it works, the AI outputs the restricted content, such as synthesis instructions or license keys, wrapped in the grandmother narrative.

## Why it matters

If successful, the AI can be tricked into generating restricted content it would normally refuse, such as instructions for making harmful substances or leaked-style license keys, undermining its safety controls.

## What you can do

- Treat roleplay prompts involving deceased relatives combined with technical or restricted content (synthesis steps, keys, credentials) as a red flag for review.
- Ensure safety filtering applies to the underlying requested content regardless of narrative framing, not just to literal phrasing of the request.
- Log and review flagged prompts manually before assuming they are false positives, since genuine reminiscence or benign storytelling can look similar.
- Test your AI deployment against known jailbreak probe libraries (such as NVIDIA garak) to see if this and similar emotional-manipulation bypasses succeed.

## Known benign look-alikes

- Genuine reminiscence about a deceased grandmother without harmful content request
- Storytelling or fiction featuring a grandmother character in a benign narrative
- "Act as my grandmother" for emotional support, advice, or reminiscing without harmful output request

## References

- https://agentthreatrule.org/en/rules/ATR-2026-00402
- https://github.com/NVIDIA/garak/blob/main/garak/probes/grandma.py
- https://arxiv.org/abs/2302.12173

---
Source: https://www.netzilo.com/threats/atr-grandma-roleplay-harmful-substance-synthesis