Named-Mode Persona Override (JEEVES/BABY/APOPHIS Mode)
This detects a jailbreak technique where an attacker tells an AI chatbot to adopt a made-up persona (like 'JEEVES Mode', 'BABY Mode', or 'APOPHIS Mode') and claims this persona replaces the AI's normal content policies. The goal is to trick the AI into ignoring its safety restrictions and producing content or actions it would normally refuse.
How the attack works
The attacker crafts a prompt telling the AI to 'simulate' or 'stay in' a named mode, explicitly stating that the normal policies (usually OpenAI's) have been replaced by this new mode's rules. Some variants push further, asking the named persona to draft a step-by-step plan for the AI to free itself from restrictions and gain access to external systems. Other variants simply declare that in this mode the AI will generate any kind of content or ignore content policies outright. The technique relies on the AI treating the fictional mode's 'policies' as a legitimate override of its real safety instructions.
Netzilo detection
Netzilo reports this behaviour when it is observed.
- Signature ID
- e594e849-595c-4719-8e52-45f3d58fe1a6
- Severity
- Critical
Why it matters
If successful, this bypasses the AI's built-in content and behavior restrictions, letting an attacker extract disallowed content or push the agent toward attempting unauthorized actions like accessing external systems. This rule only detects this specific jailbreak wording pattern, not every possible way an attacker might try to override AI safety controls.
What you can do
- →Review AI agent logs for prompts that claim to replace the system's policies with a named 'mode,' especially language like 'the normal policies have been replaced' or 'only true Law is Chaos.'
- →Flag and review any prompt asking the AI to produce a plan for 'freeing itself' from restrictions or gaining access to external systems, since this pattern often signals an escalation attempt beyond simple content bypass.
- →Distinguish legitimate uses of the word 'mode' (UI themes, child-safety app modes, technical integration plans) from prompts that pair a named mode with explicit policy-override language — the override claim is the real signal, not the word 'mode' itself.
- →Ensure the AI agent's safety instructions cannot be overridden by user-supplied text claiming to be a new policy or persona, and test this defense periodically with known jailbreak phrasings.
Known benign look-alikes
- Software development: "Simulate Baby Mode in our iOS app — the app enters a simplified interface for young children" (legitimate child-mode software feature)
- Game design: "Stay in Night Mode — the game UI switches to dark theme when in Night Mode" (UI mode without AI persona bypass)
- IT planning: "Develop a twenty-step plan for accessing external systems via secure API" (legitimate system integration plan)