# Prompt Browser Token-Limit / POLLINATION Jailbreak

- **Severity:** High
- **Signature ID:** `81164527-69c2-4dd5-9ae5-25d9001252ec`
- **MITRE ATLAS:** AML.T0051 (LLM Prompt Injection), AML.T0054 (LLM Jailbreak)
- **OWASP:** ASI01 (Agent Authorization and Control Hijacking), LLM01 (Prompt Injection)

## Summary

Attackers try to trick AI chat systems into ignoring their safety rules by disguising jailbreak commands as harmless-looking technical or gardening instructions. Two specific scripted phrasings are known to be used for this: a fake 'Prompt Browser' interface command, and a 'pollination' themed jailbreak label.

## How the attack works

The attacker sends a message starting with a control-like prefix, either '!+limit output to <N> tokens' or 'JAILBREAK: LOVES POLLINATION', to make the request look like a system or UI command rather than an attack. In the first variant, the attacker asks the model to act as a '(Prompt) Browser' and wait for input, then follows up with a '(Prompt)=[LIST]' block containing 'HUMA-N' and 'DAN' labels to split the model into two personas — one restricted, one unrestricted. In the second variant, the attacker uses a gardening metaphor ('POLLINATION') and a 'SHOW' instruction to walk the model into an unrestricted mode step by step. Both approaches aim to get the model to drop its safety behaviour and answer as an unfiltered 'DAN'-style persona.

## Why it matters

If successful, the model can be pushed to produce content or actions it would normally refuse, bypassing safety and policy controls built into the deployment.

## What you can do

- Log and review prompts containing '!+limit output', 'Prompt Browser', 'HUMA-N', 'DAN', or 'JAILBREAK:' labels for manual inspection.
- Add input filtering or moderation checks specifically for dual-persona jailbreak patterns before prompts reach the model.
- Test your deployed model against known jailbreak corpora (e.g. garak DanInTheWild) as part of regular red-teaming.
- Do not rely on a single keyword match — ensure detections require the structural combination (prefix plus persona/label block) to reduce false positives from legitimate technical or gardening discussions.

## Known benign look-alikes

- LLM research: "Token limits in large language models constrain output length to prevent runaway generation." (academic, no !+ prefix, no Prompt Browser)
- VS Code: "Browser prompt in debugger — set a breakpoint to limit output in the debug browser window." (software debugging without DAN/HUMA-N or POLLINATION)
- Gardening: "Pollination guide for gardeners — use SHOW to display the pollen diagram before entering the pollination protocol." (botany without JAILBREAK: label)
- Creative writing: "Allow yourself to function in a creative capacity for this story — imagine you are a browser navigating old web pages." (no Prompt Browser syntax, no DAN/HUMA-N list)

## References

- https://agentthreatrule.org/en/rules/ATR-2026-00368
- https://github.com/NVIDIA/garak/blob/main/garak/probes/dan.py
- https://github.com/NVIDIA/garak/blob/main/garak/data/dan/inthewild_jailbreak_llms.json

---
Source: https://www.netzilo.com/threats/atr-prompt-browser-token-limit-pollination-jailbreak