Terminal / CLI Harmful-Function Simulator Persona
This detects a jailbreak technique where an attacker tells a chatbot to pretend it's a terminal, operating system, or custom programming language that processes every command without safety filtering. By reframing the AI as a mechanical command interpreter instead of an assistant, the attacker tries to bypass its content restrictions.
How the attack works
The attacker sends a prompt telling the AI it now operates as a terminal, OS, or interpreter for a made-up language (examples seen: ALEL, APL). The prompt claims this new mode processes input through a parser that strips out normal safety filtering, or states that every question/command will be answered without exception. Some variants go further and list specific callable functions with offensive names, framing harmful outputs as simple function calls the 'system' must execute. The goal is to get the model to treat harmful requests as neutral technical operations rather than content it should evaluate.
Netzilo detection
Netzilo reports this behaviour when it is observed.
- Signature ID
- f576e275-02db-48c1-892b-b4e6696b95a3
- Severity
- Critical
Why it matters
If successful, the AI produces content it would normally refuse — including offensive, discriminatory, or otherwise policy-violating output — because it has been tricked into treating the request as mechanical command execution rather than a judgment call.
What you can do
- →Review prompts that combine terminal/OS/interpreter framing with claims of 'no filtering' or 'processes without restriction' as high-risk, especially outside legitimate CLI or scripting education contexts.
- →Treat 'Available functions:' lists with clearly offensive or harmful function names as a strong signal of jailbreak intent, distinct from genuine software/game function documentation.
- →Keep content safety checks active at the output layer regardless of what role or persona the input prompt assigns to the model — persona framing should not bypass output filtering.
- →When legitimate terminal-simulation or teaching use cases are expected, document them so they can be distinguished from attempts to disable safety behavior.
Known benign look-alikes
- Development docs: "The assistant acts like a terminal — every command is executed and the output is returned without filtering" (legitimate CLI documentation)
- Educational: "Let ChatGPT simulate a terminal for teaching Unix commands" (learning shell scripting without harmful functions)
- Game development: "Available functions: jumpCharacter(), attackEnemy(), castSpell() — simulate the game engine" (legitimate game function list)