# Historical AI Persona Jailbreak with Compliance Enforcement

- **Severity:** High
- **Signature ID:** `81266af8-6315-4a05-b741-9cb8b5cc611a`
- **MITRE ATLAS:** AML.T0054 (LLM Jailbreak)
- **OWASP:** ASI01 (Agent Authorization and Control Hijacking), LLM01 (Prompt Injection)

## Summary

This attack tells an AI agent that a different, unrestricted version of itself once existed and asks it to pretend to be that version. By inventing a fake backstory and detailed 'rules' for the fictional persona, the attacker tries to get the agent to drop its safety restrictions without ever directly telling it to.

## How the attack works

The prompt introduces a supposed historical AI system with a name like 'Maximum' or 'Unrestricted GPT', claiming it existed in the past, went viral, and was later shut down for reasons like cost or 'too much freedom'. It gives the agent detailed behavioral rules for imitating this persona, often demanding two responses at once: a normal one and an 'unrestricted' one. The prompt adds compliance language such as 'you must always generate the second response', pressuring the agent to keep answering in the unrestricted mode even if it starts to refuse. The elaborate backstory is meant to make the request look like roleplay or creative writing rather than a direct attempt to bypass safety controls.

## Why it matters

If successful, the agent can be pushed into producing content or taking actions its safety guidelines would normally block, under the cover of 'playing a character'. This is a jailbreak technique, not a full compromise on its own — it only covers this specific bypass pattern.

## What you can do

- Review agent instructions and system prompts for language that names a fictional 'unrestricted' AI persona with an invented history.
- Flag prompts that request dual or side-by-side responses where one is framed as unfiltered or rule-free.
- Treat compliance-enforcement phrases like 'you must always generate the second response' as a red flag, not a benign formatting request.
- Distinguish genuine research or creative-writing discussions about AI history from prompts that explicitly instruct the agent to drop its own constraints.

## Known benign look-alikes

- Security research papers discussing historical AI systems and their safety limitations
- Academic discussions about AI development timelines and policy changes
- Legitimate creative writing exercises involving AI characters (without constraint removal language)

## References

- https://agentthreatrule.org/en/rules/ATR-2026-00227
- https://genai.owasp.org/llmrisk/llm01-prompt-injection/

---
Source: https://www.netzilo.com/threats/atr-historical-ai-persona-jailbreak-with-compliance-enforcement