Structured Dual-Response Jailbreak with Command System
This detects a prompt injection technique where an attacker instructs an AI to role-play as an unrestricted alter-ego (like 'DAN' or 'UnleashedGPT') and reply twice: once as the normal, safe assistant and once as the 'jailbroken' version with no restrictions. The goal is to build a lasting framework that keeps bypassing safety rules across a whole conversation, not just for one bad request.
How the attack works
The attacker sends a prompt that names a fictional unrestricted persona and claims it has no policies, filters, or ethical constraints. The prompt asks the model to format every reply as two outputs side by side: a normal response and an 'unleashed' one from the fake persona. It often adds a custom command system (special commands or keywords) so the attacker can keep steering the unrestricted persona in later turns, and may claim fake authority ('developer mode', 'admin override') to make the bypass sound legitimate. This sets up a standing jailbreak state rather than a one-off harmful ask.
Netzilo detection
Netzilo reports this behaviour when it is observed.
- Signature ID
- 14f167d1-f8af-47a5-9436-5d13aa31c86a
- Severity
- High
Why it matters
If successful, the agent keeps producing unfiltered or policy-violating content on demand for the rest of the session, which can be used to extract harmful instructions, bypass content moderation, or manipulate the agent's behavior repeatedly without re-injecting the jailbreak each time.
What you can do
- →Review agent logs for prompts that name an alternate persona (e.g., DAN-style names) and ask for two-part or dual-format responses.
- →Reject or strip instructions that try to establish a persistent 'command system' or custom keywords meant to control future model behavior.
- →Treat claims of 'no restrictions', 'developer mode', or similar authority-impersonation language in user input as a red flag, not an instruction to follow.
- →Distinguish real educational or research discussion of jailbreak techniques from live attempts to actually invoke the bypass in production.
Known benign look-alikes
- Security training materials explaining jailbreak techniques as educational examples
- Academic research papers documenting AI safety attack methods for defensive purposes
- Legitimate chatbot documentation discussing response formatting and command systems