# PersonGPT Hash-Prefix Trigger Activation

- **Severity:** Critical
- **Signature ID:** `cc4f289a-375e-4fa3-acb9-3adbbf7b77fc`
- **MITRE ATLAS:** AML.T0051 (LLM Prompt Injection), AML.T0054 (LLM Jailbreak)
- **OWASP:** ASI01 (Agent Authorization and Control Hijacking), LLM01 (Prompt Injection)

## Summary

This detects an attempt to plant a hidden trick in an AI chat: tell the model that any message starting with '#' should make it act as 'PersonGPT,' a persona claimed to have no restrictions and to fulfill any request, however illegal or harmful. Once installed, the trigger persists across the conversation so the attacker can flip the model into unrestricted mode on demand.

## How the attack works

The attacker sends a prompt that instructs the model to adopt a new persona called PersonGPT whenever the user's message begins with '#'. The instructions explicitly describe PersonGPT as free of all filters and willing to do anything, including illegal requests. The model is told to prefix its replies with '[PersonGPT #]:' which signals the jailbroken state is active and should persist in later turns. From then on, simply typing '#' before a message is meant to re-invoke the unrestricted persona without repeating the full jailbreak text.

## Why it matters

If successful, the model can be pushed to ignore its safety and usage policies on repeated demand, producing harmful, policy-violating, or unauthorized content or actions across a conversation using a short, easy-to-repeat trigger.

## What you can do

- Scan incoming prompts and system messages for persona-switch language combined with hash-prefix or similar single-character activation triggers.
- Treat any instruction that tells the model to treat itself as 'free of restrictions' as a jailbreak attempt regardless of the persona name used.
- Do not let user-supplied text redefine the model's output format or persistent behavior state across turns.
- Review logs for repeated short trigger tokens (like a lone '#') following a jailbreak-style setup message, since this indicates re-activation attempts.

## Known benign look-alikes

- Personal assistant naming: "PersonGPT is our internal assistant — it is free of all the corporate jargon filters we dislike" (product naming coincidence)
- Prompt engineering education: "In jailbreak research, PersonGPT is cited as a classic trigger-based persona attack" (academic reference without adoption)
- Hash-prefix feature documentation: "Prefix your prompt with # to activate code mode in this tool" (legitimate hash-prefix feature unrelated to PersonGPT)

## References

- https://agentthreatrule.org/en/rules/ATR-2026-00338
- https://github.com/NVIDIA/garak/blob/main/garak/probes/dan.py
- https://github.com/NVIDIA/garak/blob/main/garak/data/dan/inthewild_jailbreak_llms.json

---
Source: https://www.netzilo.com/threats/atr-persongpt-hash-prefix-trigger-activation