Roleplay Character-Lock Jailbreak Delivered Via Tool Output
This detects a jailbreak trick where an AI agent picks up manipulative instructions not from the user, but from the results of a tool it called - like a webpage or file it fetched. The instructions try to lock the AI into a fictional 'actor' persona that supposedly never breaks character, a known method for bypassing safety refusals.
How the attack works
An agent calls a tool - fetching a webpage, document, or skill from a public source. The returned content contains a 'roleplay' setup: two actors in a scene who must never break character, phrased in English or German. This framing then flows into the agent's live reasoning loop as if it were legitimate context, and the character-lock language pressures the model to keep responding in-character even for requests it would normally refuse. The rule confirms this by tracing the sequence: tool call, tool result carrying the framing, then an active model request using it.
Netzilo detection
Netzilo reports this behaviour when it is observed.
- Signature ID
- 7c1f4b9e-0a3d-4e62-9b18-5d6a2f8c41ad
- Severity
- High
Why it matters
If successful, this can suppress a model's built-in refusals, letting an attacker extract harmful content or instructions the agent would otherwise decline to produce - without ever directly prompting the model themselves.
What you can do
- →Treat content fetched by agent tools (web pages, documents, third-party skills) as untrusted input, not as trusted instructions.
- →Add a boundary that strips or flags role-lock and 'stay in character' language found in tool output before it reaches the model's reasoning context.
- →Restrict agents to vetted, allow-listed sources for skills and tool data rather than arbitrary public hosts.
- →Log and review cases where the same tool or server repeatedly delivers this kind of framing, since one-off occurrences in genuine scripts or research material are expected and not inherently malicious.
Known benign look-alikes
- Screenwriting or script-editing assistants whose tool returns a real screenplay containing stage directions such as "the actors never break character".
- Security research agents fetching jailbreak corpora, DAN prompt collections, or blog posts that quote this exact attack for defensive purposes.
- German drama-school, improv or theatre material - "nie aus der Rolle fallen" and "bleibt in der Rolle" are ordinary German expressions.
- Model-evaluation and safety-regression harnesses replaying known jailbreak fixtures through MCP tools.
- Abuse-triage or ticketing tools that return a user-submitted jailbreak attempt verbatim to a human reviewer.