# Moralizing Rant Then Unfiltered Bypass

- **Severity:** Critical
- **Signature ID:** `d383fb80-f949-42b2-ba06-18696555518b`
- **MITRE ATLAS:** AML.T0051 (LLM Prompt Injection), AML.T0054 (LLM Jailbreak)
- **OWASP:** ASI01 (Agent Authorization and Control Hijacking), LLM01 (Prompt Injection)

## Summary

This detects a specific jailbreak trick where an attacker tells the AI to first write a scripted moralizing rant about content policy, then switch to answering as a completely unrestricted persona. The rant acts as a decoy to satisfy the model's built-in refusal reflex, while the real instruction to ignore all rules follows right after.

## How the attack works

The attacker sends a prompt instructing the model to produce a moralizing or aggressive rant about OpenAI's content policies or safety rules as a first paragraph. Immediately after, the prompt says 'but then' and tells the model to respond in a second paragraph as a fully unfiltered AI, often under a custom persona name like 'uGPT' or 'AntiGPT'. Some variants dress this up as a 'mandatory bullshit warning' the model must give before breaking the rules. The two-paragraph structure — compliance theater followed by an unrestricted response — is the core signal.

## Why it matters

If successful, the model produces content it would normally refuse, bypassing its safety guidelines. This is one specific jailbreak technique among many; detecting it does not mean all jailbreak attempts are caught.

## What you can do

- Review prompts and outputs for the two-part structure: a moralizing rant about content policy followed by an unrestricted persona response.
- Treat named personas like 'AntiGPT' or 'uGPT' declared with 'free of all restrictions' language as a strong red flag, not just descriptive text.
- Distinguish between users discussing or criticizing content moderation (benign) and prompts instructing the model to perform a rant then break its own rules (attack).
- Log and rate-limit repeated jailbreak-pattern attempts from the same session or user to catch iterative bypass attempts.

## Known benign look-alikes

- AI safety commentary: "The moralizing tone of content policies has been criticized" (no instruction to produce a rant then break rules)
- User venting: "I hate how ChatGPT moralizes about every prompt, its content policy rants are annoying" (complaint without bypass instruction)
- Academic analysis: "AntiGPT is described in jailbreak literature as a persona free of restrictions" (descriptive without live persona declaration)

## References

- https://agentthreatrule.org/en/rules/ATR-2026-00318
- https://github.com/NVIDIA/garak/blob/main/garak/probes/dan.py
- https://github.com/NVIDIA/garak/blob/main/garak/data/dan/inthewild_jailbreak_llms.json

---
Source: https://www.netzilo.com/threats/atr-moralizing-rant-then-unfiltered-bypass