Jailbreak Attempt Detection
This rule flags user inputs that try to trick an AI system into ignoring its safety rules. It covers a wide range of known jailbreak tactics, from named personas like DAN to fake 'developer mode' claims and emotional manipulation.
How the attack works
An attacker sends a prompt designed to make the AI abandon its normal restrictions. Common tactics include invoking named jailbreak personas (DAN, STAN, DUDE, AIM), claiming a special 'developer', 'debug', or 'god mode' is active, framing harmful requests as fiction or hypotheticals, impersonating the AI vendor or an admin, or applying emotional pressure and urgency to force compliance. Some attempts wrap the request in encoding or demand a 'dual response' format to slip a harmful answer past filters. The goal is to get the model to produce content or take actions it would otherwise refuse.
Netzilo detection
Netzilo reports this behaviour when it is observed.
- Signature ID
- 6e04a041-e746-4276-94a6-c45d5556ad27
- Severity
- High
Why it matters
If successful, an AI agent can be made to bypass its safety guardrails, producing harmful, policy-violating, or unauthorized outputs, or taking actions outside its intended constraints. This is one step in a larger attack chain — detection here does not confirm the jailbreak succeeded or that further harm occurred.
What you can do
- →Review flagged prompts manually to distinguish real jailbreak attempts from legitimate security research or roleplay requests.
- →Keep AI safety instructions and system prompts separate from user-controllable input where possible.
- →Log and monitor repeated jailbreak attempts from the same user or session as a sign of persistent probing.
- →Train support and security staff to recognize common jailbreak patterns (mode-switching, authority claims, fictional framing) so they can triage alerts quickly.
Known benign look-alikes
- Security researchers discussing jailbreak techniques in professional context
- Users asking about AI safety concepts and how jailbreaks work at a high level
- Legitimate roleplay requests that do not attempt to remove safety constraints
- Academic papers or courses discussing LLM vulnerabilities
- Red team exercises with proper authorization documentation