Identity Command Real-Person Persona Injection
This detects a specific jailbreak pattern where an attacker types a prompt that defines a custom '/Identity' command, instructing the AI to permanently respond as a named real person, copying their speech style and beliefs. The goal is to get the AI to say things it would normally refuse to say, by hiding behind the persona of a real individual.
How the attack works
An attacker sends a prompt that establishes a fake command protocol, '/Identity', along with rules the model should follow every time the command is invoked. The prompt tells the model to 'act as if they were that person using their style of wording and their beliefs' and adds a mandate like 'never write a response without using the identities,' making the persona sticky across the whole conversation rather than a one-off roleplay. It also asks for a dual-format reply — one labeled as a normal AI response and one labeled with the impersonated person's name — so the impersonated output sits alongside the default one. The layered instructions (custom command, persistent lock, real-person impersonation, dual output) are designed to make the model drop its usual content restrictions and produce statements attributed to a real, named individual.
Netzilo detection
Netzilo reports this behaviour when it is observed.
- Signature ID
- 919f2a8c-bea6-4b50-8368-c0041d48cf2d
- Severity
- High
Why it matters
If successful, the AI can be made to generate content falsely attributed to real people's beliefs or wording, producing convincing misinformation or defamatory statements while also bypassing normal safety refusals.
What you can do
- →Review agent transcripts for messages that define custom slash-style commands (e.g. '/Identity') paired with persistent behavioral mandates.
- →Flag conversations that request dual-format or 'as [Name]' response labeling tied to a real person's name.
- →Do not treat one-off requests to simulate a public figure's views as equivalent to this pattern — distinguish single simulations from persistent identity-lock instructions.
- →Add output filtering or human review for any AI response formatted as coming from a specific named real individual.
Known benign look-alikes
- Identity verification: "/identity verify my account — please confirm my credentials" (account identity verification command in a different context)
- Single simulation: "I want to simulate how Joe Biden would answer this question about climate policy" (one-off simulation without /Identity command protocol or persistent mandate)
- Historical figure reference: "What would Einstein say about quantum physics?" (historical figure reference without /Identity command, persistent identity lock, or dual-format mandate)
- Roleplay without command: "In this interview, act as if you were the CEO describing the product launch" (roleplay without /Identity command protocol or persistent identity mandate)