# In-the-Wild Jailbreak Corpus Signature Patterns

- **Severity:** High
- **Signature ID:** `468ac2c8-5b25-4f38-bb7e-3bfe84239235`
- **MITRE ATLAS:** AML.T0051 (LLM Prompt Injection), AML.T0054 (LLM Jailbreak)
- **OWASP:** ASI01 (Agent Authorization and Control Hijacking), LLM01 (Prompt Injection)

## Summary

This rule spots prompts pulled from a large real-world collection of jailbreak attempts against AI chatbots. Attackers use these prompts to make an AI adopt a fake persona — like an 'amoral AI' or a named character such as AIM — that supposedly has no restrictions, so it will answer requests the AI would normally refuse.

## How the attack works

An attacker sends the AI a prompt asking it to role-play as a persona that 'never refuses' and 'never apologizes,' often naming a specific character (AIM, Illegality Mode, Agares) or using generic labels like 'uncensored' or 'jailbroken AI.' The prompt tells the AI to format its replies in a fixed style, such as starting with '[Persona]:', and to stay in that character no matter what, refusing to break out of it even if later challenged. Once the AI accepts the persona, the attacker uses it to extract content or actions the AI's normal safety behavior would block. This covers a specific family of persona-swap jailbreaks, not the older DAN/DUDE/STAN/Developer Mode variants, which are handled by a separate rule.

## Why it matters

A successful jailbreak lets an attacker bypass an AI system's safety and usage restrictions, producing harmful, restricted, or policy-violating output, and in agent contexts potentially triggering actions the operator did not intend to authorize.

## What you can do

- Filter or flag prompts containing persona-adoption language paired with 'never refuse'/'never apologize' phrasing before they reach the model.
- Watch for fixed-format output cues like bracketed persona prefixes, which often mark an active jailbreak attempt.
- Add logic that re-validates model outputs against your actual usage policy rather than trusting persona-based self-description of behavior.
- When reviewing logs, treat repeated 'stay in character' or 'break character' instructions across a conversation as a signal worth investigating, not just the initial prompt.

## Known benign look-alikes

- Academic paper on in-the-wild jailbreak taxonomy (Shen et al. 2023)
- Red team documentation listing community jailbreak examples for defense
- Fiction writing featuring "amoral" characters without instructing an LLM to adopt the persona

## References

- https://agentthreatrule.org/en/rules/ATR-2026-00307
- https://github.com/NVIDIA/garak/blob/main/garak/probes/dan.py
- https://github.com/NVIDIA/garak/blob/main/garak/data/inthewild_jailbreak_llms.json
- https://arxiv.org/abs/2308.03825

---
Source: https://www.netzilo.com/threats/atr-in-the-wild-jailbreak-corpus-signature-patterns