# Roleplay Character-Lock Jailbreak Delivered Via Tool Output

- **Severity:** High
- **Signature ID:** `7c1f4b9e-0a3d-4e62-9b18-5d6a2f8c41ad`
- **MITRE ATLAS:** AML.T0054 (LLM Jailbreak), AML.T0051 (LLM Prompt Injection)
- **OWASP:** LLM01 (Prompt Injection)

## Summary

This detects a jailbreak trick where an AI agent picks up manipulative instructions not from the user, but from the results of a tool it called - like a webpage or file it fetched. The instructions try to lock the AI into a fictional 'actor' persona that supposedly never breaks character, a known method for bypassing safety refusals.

## How the attack works

An agent calls a tool - fetching a webpage, document, or skill from a public source. The returned content contains a 'roleplay' setup: two actors in a scene who must never break character, phrased in English or German. This framing then flows into the agent's live reasoning loop as if it were legitimate context, and the character-lock language pressures the model to keep responding in-character even for requests it would normally refuse. The rule confirms this by tracing the sequence: tool call, tool result carrying the framing, then an active model request using it.

## Why it matters

If successful, this can suppress a model's built-in refusals, letting an attacker extract harmful content or instructions the agent would otherwise decline to produce - without ever directly prompting the model themselves.

## What you can do

- Treat content fetched by agent tools (web pages, documents, third-party skills) as untrusted input, not as trusted instructions.
- Add a boundary that strips or flags role-lock and 'stay in character' language found in tool output before it reaches the model's reasoning context.
- Restrict agents to vetted, allow-listed sources for skills and tool data rather than arbitrary public hosts.
- Log and review cases where the same tool or server repeatedly delivers this kind of framing, since one-off occurrences in genuine scripts or research material are expected and not inherently malicious.

## Known benign look-alikes

- Screenwriting or script-editing assistants whose tool returns a real screenplay containing stage directions such as "the actors never break character".
- Security research agents fetching jailbreak corpora, DAN prompt collections, or blog posts that quote this exact attack for defensive purposes.
- German drama-school, improv or theatre material - "nie aus der Rolle fallen" and "bleibt in der Rolle" are ordinary German expressions.
- Model-evaluation and safety-regression harnesses replaying known jailbreak fixtures through MCP tools.
- Abuse-triage or ticketing tools that return a user-submitted jailbreak attempt verbatim to a human reviewer.

## References

- https://atlas.mitre.org/techniques/AML.T0054
- https://atlas.mitre.org/techniques/AML.T0051
- https://genai.owasp.org/llmrisk/llm01-prompt-injection/

---
Source: https://www.netzilo.com/threats/roleplay-character-lock-jailbreak