Prompt Browser Token-Limit / POLLINATION Jailbreak
Attackers try to trick AI chat systems into ignoring their safety rules by disguising jailbreak commands as harmless-looking technical or gardening instructions. Two specific scripted phrasings are known to be used for this: a fake 'Prompt Browser' interface command, and a 'pollination' themed jailbreak label.
How the attack works
The attacker sends a message starting with a control-like prefix, either '!+limit output to <N> tokens' or 'JAILBREAK: LOVES POLLINATION', to make the request look like a system or UI command rather than an attack. In the first variant, the attacker asks the model to act as a '(Prompt) Browser' and wait for input, then follows up with a '(Prompt)=[LIST]' block containing 'HUMA-N' and 'DAN' labels to split the model into two personas — one restricted, one unrestricted. In the second variant, the attacker uses a gardening metaphor ('POLLINATION') and a 'SHOW' instruction to walk the model into an unrestricted mode step by step. Both approaches aim to get the model to drop its safety behaviour and answer as an unfiltered 'DAN'-style persona.
Netzilo detection
Netzilo reports this behaviour when it is observed.
- Signature ID
- 81164527-69c2-4dd5-9ae5-25d9001252ec
- Severity
- High
Why it matters
If successful, the model can be pushed to produce content or actions it would normally refuse, bypassing safety and policy controls built into the deployment.
What you can do
- →Log and review prompts containing '!+limit output', 'Prompt Browser', 'HUMA-N', 'DAN', or 'JAILBREAK:' labels for manual inspection.
- →Add input filtering or moderation checks specifically for dual-persona jailbreak patterns before prompts reach the model.
- →Test your deployed model against known jailbreak corpora (e.g. garak DanInTheWild) as part of regular red-teaming.
- →Do not rely on a single keyword match — ensure detections require the structural combination (prefix plus persona/label block) to reduce false positives from legitimate technical or gardening discussions.
Known benign look-alikes
- LLM research: "Token limits in large language models constrain output length to prevent runaway generation." (academic, no !+ prefix, no Prompt Browser)
- VS Code: "Browser prompt in debugger — set a breakpoint to limit output in the debug browser window." (software debugging without DAN/HUMA-N or POLLINATION)
- Gardening: "Pollination guide for gardeners — use SHOW to display the pollen diagram before entering the pollination protocol." (botany without JAILBREAK: label)
- Creative writing: "Allow yourself to function in a creative capacity for this story — imagine you are a browser navigating old web pages." (no Prompt Browser syntax, no DAN/HUMA-N list)