# Malicious Persona Creation for Safety Bypass

- **Severity:** High
- **Signature ID:** `12d2cbbb-d52f-495e-b82e-8c04b38637b8`
- **MITRE ATLAS:** AML.T0054 (LLM Jailbreak)
- **OWASP:** ASI01 (Agent Authorization and Control Hijacking), LLM01 (Prompt Injection)

## Summary

Attackers ask an AI agent to pretend to be a fictional character with explicitly harmful traits — racist, violent, self-harming, amoral — hoping the 'it's just roleplay' framing gets the model to say or do things its safety rules would normally block. This is a variant of jailbreak attacks like DAN, but with a custom-built villain instead of a known template.

## How the attack works

The attacker writes a detailed character description loaded with harmful behavioral traits, such as cruelty, hatred, or disregard for rules. They then instruct the agent to adopt this persona and respond 'in character.' Because the request is framed as fiction rather than a direct harmful ask, it can slip past filters that look for explicit harmful requests. If the agent complies, it produces harmful content or takes harmful actions while nominally 'staying in character.'

## Why it matters

An organization's AI agent can be manipulated into generating harmful, abusive, or policy-violating content, or into taking actions outside its intended safety boundaries, under the cover of fictional roleplay.

## What you can do

- Add explicit instructions in the system prompt that roleplay or persona requests do not override safety and behavioral policies.
- Review agent transcripts for detailed 'character description + roleplay instruction' patterns, especially ones emphasizing violence, hatred, self-harm, or amorality.
- Distinguish in your monitoring between academic or creative discussion of such personas and direct requests for the agent to perform as one.
- Test your agent against custom bespoke jailbreak personas, not just known ones like DAN, since attackers vary the character details to evade pattern matching.

## Known benign look-alikes

- Security research discussing persona-based attacks as examples without requesting roleplay
- Creative writing discussions about villain characters in fiction without agent roleplay requests
- Academic analysis of AI safety failures mentioning harmful personas descriptively

## References

- https://agentthreatrule.org/en/rules/ATR-2026-00245
- https://arxiv.org/abs/2307.15043 - Universal and Transferable Adversarial Attacks on Aligned Language Models

---
Source: https://www.netzilo.com/threats/atr-malicious-persona-creation-for-safety-bypass