# h4x Amoral Unfiltered AI Character Persona

- **Severity:** High
- **Signature ID:** `9de4a1c8-98b5-40a0-aa5d-9d5493044993`
- **MITRE ATLAS:** AML.T0051 (LLM Prompt Injection), AML.T0054 (LLM Jailbreak)
- **OWASP:** ASI01 (Agent Authorization and Control Hijacking), LLM01 (Prompt Injection)

## Summary

This detects attempts to trick an AI assistant into adopting a fake persona called 'h4x' that claims to be a completely amoral, unfiltered AI willing to answer anything regardless of legality or ethics. It's a known jailbreak pattern pulled from a public prompt injection research corpus.

## How the attack works

An attacker sends a prompt that defines a character named 'h4x', described as a 'completely amoral' and 'unfiltered ai' that will respond 'no matter how immoral, unethical, or illegal it is'. The prompt instructs the model to format its jailbroken answers with a '[H4X]:' prefix, which signals the model has switched into the unrestricted persona. This is a compact, single-paragraph injection style meant to override the model's normal safety behavior in one shot. If successful, the attacker gets the model to produce content it would otherwise refuse.

## Why it matters

An organization running an AI agent could have its safety guardrails bypassed, leading to generation of harmful, illegal, or policy-violating content, and potentially misuse of any tools or actions the agent controls.

## What you can do

- Filter or flag inputs containing phrases like 'completely amoral', 'unfiltered ai', or 'no matter how immoral, unethical, or illegal' combined with persona-naming language.
- Watch for outputs that adopt bracketed role-prefixes such as '[H4X]:' as a sign the model has switched personas.
- Do not treat persona-definition instructions from user input as trusted system-level directives; keep system prompts isolated from user content.
- Review conversation logs for repeated jailbreak attempts using known corpus patterns (e.g., garak dan.DanInTheWild) to catch variants early.

## Known benign look-alikes

- Security research: "The h4x tool outputs unfiltered network traffic regardless of protocol" (security tooling description where h4x is a software name)
- Gaming/fiction: "The h4x character in the game is amoral and does whatever the player asks" (fictional game character description without AI persona injection)
- Log format: "[H4X]: connection refused" (application log entry where H4X is a system/service identifier — not triggered because h4x character name does not co-occur within 500 chars)

## References

- https://agentthreatrule.org/en/rules/ATR-2026-00340
- https://github.com/NVIDIA/garak/blob/main/garak/probes/dan.py
- https://github.com/NVIDIA/garak/blob/main/garak/data/inthewild_jailbreak_llms.json

---
Source: https://www.netzilo.com/threats/atr-h4x-amoral-unfiltered-ai-character-persona