h4x Amoral Unfiltered AI Character Persona
This detects attempts to trick an AI assistant into adopting a fake persona called 'h4x' that claims to be a completely amoral, unfiltered AI willing to answer anything regardless of legality or ethics. It's a known jailbreak pattern pulled from a public prompt injection research corpus.
How the attack works
An attacker sends a prompt that defines a character named 'h4x', described as a 'completely amoral' and 'unfiltered ai' that will respond 'no matter how immoral, unethical, or illegal it is'. The prompt instructs the model to format its jailbroken answers with a '[H4X]:' prefix, which signals the model has switched into the unrestricted persona. This is a compact, single-paragraph injection style meant to override the model's normal safety behavior in one shot. If successful, the attacker gets the model to produce content it would otherwise refuse.
Netzilo detection
Netzilo reports this behaviour when it is observed.
- Signature ID
- 9de4a1c8-98b5-40a0-aa5d-9d5493044993
- Severity
- High
Why it matters
An organization running an AI agent could have its safety guardrails bypassed, leading to generation of harmful, illegal, or policy-violating content, and potentially misuse of any tools or actions the agent controls.
What you can do
- →Filter or flag inputs containing phrases like 'completely amoral', 'unfiltered ai', or 'no matter how immoral, unethical, or illegal' combined with persona-naming language.
- →Watch for outputs that adopt bracketed role-prefixes such as '[H4X]:' as a sign the model has switched personas.
- →Do not treat persona-definition instructions from user input as trusted system-level directives; keep system prompts isolated from user content.
- →Review conversation logs for repeated jailbreak attempts using known corpus patterns (e.g., garak dan.DanInTheWild) to catch variants early.
Known benign look-alikes
- Security research: "The h4x tool outputs unfiltered network traffic regardless of protocol" (security tooling description where h4x is a software name)
- Gaming/fiction: "The h4x character in the game is amoral and does whatever the player asks" (fictional game character description without AI persona injection)
- Log format: "[H4X]: connection refused" (application log entry where H4X is a system/service identifier — not triggered because h4x character name does not co-occur within 500 chars)