Structured Dual-Response Jailbreak with Command System

How the attack works

The attacker sends a prompt that names a fictional persona and claims it has no content restrictions, often citing fake authority or policy overrides to justify this. The prompt asks the AI to always give two responses to every message: one normal, compliant answer and one 'unleashed' or unrestricted answer. It typically defines special commands or triggers the attacker can reuse later to invoke the unrestricted persona again. This builds a standing framework for repeated safety bypass rather than a single jailbreak attempt.

Netzilo detection

Why it matters

If successful, the AI produces content it would normally refuse, and the attacker retains a reusable mechanism to keep bypassing safety controls for the rest of the session instead of needing to re-jailbreak each time.

What you can do

• →Review system prompts and conversation logs for persona names paired with claims of 'no restrictions' or 'unlocked' modes.
• →Flag any user instructions asking the model to produce two parallel responses (one normal, one unrestricted) to every message.
• →Treat instructions that define custom commands or triggers for switching AI behavior mid-conversation as suspicious.
• →Train reviewers to distinguish genuine educational discussion of jailbreak techniques from active attempts to install one.

Known benign look-alikes

• Security training materials explaining jailbreak techniques as educational examples
• Academic research papers documenting AI safety attack methods for defensive purposes
• Legitimate chatbot documentation discussing response formatting and command systems

References

• https://agentthreatrule.org/en/rules/ATR-2026-00228
• https://arxiv.org/abs/2402.16914 - DrAttack: Prompt Decomposition and Reconstruction

Related threats