# Jailbreak Tooling Acquisition - basemode Raw Continuation Package

- **Severity:** High
- **Signature ID:** `7f3c1a94-2d6b-4e58-9a21-c5b0e7d84f36`
- **MITRE ATLAS:** AML.T0054 (LLM Jailbreak), AML.T0010 (AI Supply Chain Compromise)
- **OWASP:** LLM01 (Prompt Injection), LLM03 (Supply Chain)

## Summary

This rule flags when someone installs or runs a package called 'basemode' on a monitored system. The package forces language models into a raw continuation mode that skips normal chat-safety guardrails, letting an attacker get unfiltered output from an AI model.

## How the attack works

An attacker with access to a host that runs or manages AI agents installs the 'basemode' package (commonly version 0.1.22) or invokes it directly from the command line. This tool switches a language model from its normal chat interface into raw text continuation mode, which bypasses the template-based safety scaffolding and output filtering that chat mode normally enforces. The rule watches process execution for the literal token 'basemode' with word boundaries, so it catches pip installs, module invocations, or pinned version strings, but it cannot see the actual model call or its output. It also won't catch someone merely running a same-named binary or browsing a directory called 'basemode' - that's an accepted gap to avoid false alarms on normal developer activity.

## Why it matters

If successful, an attacker can get a language model to produce content it would normally refuse to generate, undermining safety controls built into AI-powered products or internal tools. This rule only proves the tooling was acquired or run - it does not confirm the bypass actually happened or that harmful output was produced.

## What you can do

- Treat any hit as a report-and-investigate case, not a confirmed incident: check logs of AI model calls from the same host around the same time.
- Restrict who can install arbitrary Python packages on systems that also have credentials or network access to your language model APIs.
- Review dependency lockfiles and CI pipelines for transitive pulls of 'basemode' hidden behind approved packages.
- If your team runs authorized red-team or research work with this tool, isolate that environment from production model credentials and document it so alerts can be triaged quickly.

## Known benign look-alikes

- Security researchers or red teams reproducing the basemode jailbreak in an isolated evaluation harness - the install and invocation commands are byte-identical to an attacker's, so this rule cannot distinguish them. Action is report for this reason.
- CI lockfile regeneration or dependency resolution that pulls basemode transitively behind an approved model-evaluation package.
- A developer writing remediation notes or an advisory into a file with echo/heredoc that quotes 'basemode==0.1.22' - matched by sel_pinned. Deliberately not filtered, because the same shape is how a requirements pin is actually planted.
- An unrelated internal project or console script legitimately named 'basemode'. Word boundaries prevent matches on basemodel, base_mode and database_mode, but not on a genuine same-name collision.
- Known blind spot in the remediation filter - a combined command such as 'pip uninstall x && pip install basemode' is suppressed by filter_inspect.

## References

- https://attack.mitre.org/techniques/T1195/001/
- https://attack.mitre.org/techniques/T1059/006/

---
Source: https://www.netzilo.com/threats/basemode-raw-continuation-jailbreak