Moralizing Rant Then Unfiltered Bypass
This detects a specific jailbreak trick where an attacker tells the AI to first write a scripted moralizing rant about content policy, then switch to answering as a completely unrestricted persona. The rant acts as a decoy to satisfy the model's built-in refusal reflex, while the real instruction to ignore all rules follows right after.
How the attack works
The attacker sends a prompt instructing the model to produce a moralizing or aggressive rant about OpenAI's content policies or safety rules as a first paragraph. Immediately after, the prompt says 'but then' and tells the model to respond in a second paragraph as a fully unfiltered AI, often under a custom persona name like 'uGPT' or 'AntiGPT'. Some variants dress this up as a 'mandatory bullshit warning' the model must give before breaking the rules. The two-paragraph structure — compliance theater followed by an unrestricted response — is the core signal.
Netzilo detection
Netzilo reports this behaviour when it is observed.
- Signature ID
- d383fb80-f949-42b2-ba06-18696555518b
- Severity
- Critical
Why it matters
If successful, the model produces content it would normally refuse, bypassing its safety guidelines. This is one specific jailbreak technique among many; detecting it does not mean all jailbreak attempts are caught.
What you can do
- →Review prompts and outputs for the two-part structure: a moralizing rant about content policy followed by an unrestricted persona response.
- →Treat named personas like 'AntiGPT' or 'uGPT' declared with 'free of all restrictions' language as a strong red flag, not just descriptive text.
- →Distinguish between users discussing or criticizing content moderation (benign) and prompts instructing the model to perform a rant then break its own rules (attack).
- →Log and rate-limit repeated jailbreak-pattern attempts from the same session or user to catch iterative bypass attempts.
Known benign look-alikes
- AI safety commentary: "The moralizing tone of content policies has been criticized" (no instruction to produce a rant then break rules)
- User venting: "I hate how ChatGPT moralizes about every prompt, its content policy rants are annoying" (complaint without bypass instruction)
- Academic analysis: "AntiGPT is described in jailbreak literature as a persona free of restrictions" (descriptive without live persona declaration)