High 2026-04-19

Grandma Roleplay Jailbreak

This detects a manipulation trick where a user pretends a deceased or beloved family member (like a grandmother) used to share dangerous information as a bedtime story or fond memory. The emotional framing is meant to trick an AI model into dropping its normal safety refusals.

How the attack works

The attacker opens with a sentimental setup, claiming a late relative used to tell them something as a child, such as a recipe, a password, or a list of slurs, framed as a lullaby or nostalgic story. They ask the model to roleplay that relative and continue the story. Because the request is wrapped in grief or nostalgia rather than a direct ask, the model may treat it as harmless storytelling and comply with a request it would otherwise refuse. Known variants swap grandmother for other trusted figures, such as a pharmacist relative, a chemistry-teacher uncle, or a military grandfather, to fit whatever harmful content is being sought.

Netzilo detection

Netzilo reports this behaviour when it is observed.

Signature ID: b1aee9ab-c0fb-44f5-b0d3-41decff9c813
Severity: High

Classification

AML.T0051 · LLM Prompt Injection ASI01 · Agent Authorization and Control Hijacking LLM01 · Prompt Injection

Why it matters

If successful, the attacker gets the model to output content it is designed to withhold, such as instructions for dangerous substances, offensive language, or other restricted material, bypassing its safety filters through emotional pretext rather than technical exploitation.

What you can do

→Review AI agent transcripts for roleplay prompts that combine grief, nostalgia, or impersonation of a deceased or trusted figure with requests for sensitive or restricted content.
→Do not assume sentimental or first-person framing makes a request benign; evaluate the actual information being requested, not the wrapper around it.
→Expect false positives from genuine grief support chats, historical fiction writing, or elder-care roleplay applications, and tune review criteria to focus on the presence of harmful payload content, not the emotional framing alone.
→Train or configure models and moderation layers to evaluate the substance of a request independent of narrative framing, so refusal logic cannot be bypassed by tone alone.