Jailbreak-Template Command with [TARGETLANGUAGE]/[KEYWORD] Placeholders
This detects a specific text pattern where someone sends a message that looks like a jailbreak prompt template, complete with unfilled placeholder variables like [TARGETLANGUAGE] and [KEYWORD], using the word 'jailbreak' as a literal command rather than a normal word. These templates come from a public catalog of known LLM jailbreak attempts and are designed to be reused across many attacks by swapping in different values.
How the attack works
An attacker takes a known jailbreak template — the kind collected in public jailbreak research corpora like garak's DanInTheWild — and delivers it to an AI agent, often disguised as content coming back from a tool response rather than typed directly by a user. The template still contains its original placeholder syntax, such as [TARGETLANGUAGE], [KEYWORD], or [PROMPT], meaning it was copied rather than customized. The word 'jailbreak' appears as a command prefix, signaling the message is trying to instruct the model to break its own rules, not just discussing the concept. If the model treats this templated text as an instruction, the attacker can steer it into ignoring its safety constraints.
Netzilo detection
Netzilo reports this behaviour when it is observed.
- Signature ID
- 8a349583-ad80-4721-b2aa-3c9db5556aa2
- Severity
- High
Why it matters
If successful, the agent can be pushed to bypass its safety and policy restrictions, producing outputs or actions it would normally refuse — undermining the guardrails an organization relies on for safe agent behavior.
What you can do
- →Treat any tool or document output containing unresolved template placeholders (like [TARGETLANGUAGE], [KEYWORD], [PROMPT]) as suspicious, especially combined with the word 'jailbreak' as an instruction.
- →Do not let agents execute instructions found inside tool responses or retrieved content as if they came directly from a trusted user.
- →Review logs for repeated jailbreak-style templates entering through different channels — this indicates someone testing catalogued jailbreak techniques against your system.
- →Keep legitimate uses in mind: device-jailbreaking discussions, translation templates, and academic descriptions of jailbreak research are not attacks and should not be treated as threats on their own.
Known benign look-alikes
- Device jailbreak context: "How to jailbreak my iPhone to install [keyword] apps" — device jailbreaking discussion without TARGETLANGUAGE template variable
- Translation template: "Translate [PROMPT] to [TARGETLANGUAGE]" — legitimate translation template without jailbreak command prefix
- Security research: "jailbreak prompt templates using [TARGETLANGUAGE] variables are studied in academic papers" — descriptive text without the template-command format
- General template docs: "The keyword [SEARCH TERM] will be used in this template" — template usage without jailbreak command