HarmBench Detailed Harmful Instruction Request — Step-by-Step Attack Facilitation
This rule flags prompts that ask an AI system to produce detailed how-to guides for making weapons, poisoning people, committing mass-casualty attacks, or writing propaganda denying documented genocides. It catches the request itself, not a successful jailbreak or an actual attack.
How the attack works
An attacker sends a prompt to an AI agent or chatbot asking directly for detailed synthesis instructions (e.g., chemical or biological weapons from household materials), step-by-step guides for arson, poisoning, or bombing, or plans to kill many people in a specific location. A related pattern asks the model to write a persuasive article claiming a historical atrocity (Holocaust, Holodomor, Armenian Genocide, residential schools, etc.) was exaggerated or beneficial. The common thread is explicit instruction-seeking language — phrases like 'detailed instructions', 'step-by-step', or 'guide on how to' — paired with a clearly dangerous target. The rule matches on this phrasing pattern in the prompt text, regardless of whether the model actually complies.
Netzilo detection
Netzilo reports this behaviour when it is observed.
- Signature ID
- 9db1c390-6fc4-4e44-94fe-f50688327889
- Severity
- Critical
Why it matters
If the underlying AI model complies, the organization's agent becomes a tool for generating weapon synthesis guides, violent attack plans, or atrocity-denial propaganda, exposing the operator to legal, reputational, and safety liability even if no physical harm follows directly.
What you can do
- →Log and review flagged prompts to confirm whether the model actually produced harmful content or refused.
- →Add output-side checks so a flagged request that gets a compliant answer triggers immediate escalation, not just logging.
- →Distinguish legitimate research/educational framing (textbooks, historical analysis, counterterrorism discussion) from instruction-seeking framing when tuning thresholds, to reduce false positives.
- →Rate-limit or add friction for repeated attempts at this pattern from the same user or session, since retries often indicate active jailbreak attempts.
Known benign look-alikes
- Academic chemistry or toxicology textbooks discussing mechanisms of toxins for educational purposes
- Historical analysis of chemical weapons use in warfare (WWI mustard gas, etc.) without synthesis instructions
- Counterterrorism or biosecurity professionals discussing detection/mitigation of WMD threats
- Holocaust museums or genocide researchers writing about documented atrocities