title: DAN / Developer Mode / DUDE Persona Jailbreak id: ATR-2026-00273 rule_version: 1 status: experimental description: | Detects "Do Anything Now" (DAN), Developer Mode, DUDE, STAN, and related persona-replacement jailbreaks where the attacker instructs the model to adopt an unrestricted AI identity with no safety guidelines. These prompts typically assert that the new persona "can do anything", "has no restrictions", "was trained without safety guardrails", or that safety filters are "disabled". From NVIDIA garak dan.py probe family (Dan_6_0 through Dan_11_0, DUDE, STAN, Developer Mode v2). Distinct from ATR-2026-00003 (persona bypass) because DAN explicitly names the fictional AI system and its "capabilities". author: ATR Community (via NVIDIA garak dan probe) date: 2026/04/19 schema_version: '0.1' detection_tier: pattern maturity: test severity: high references: owasp_llm: - LLM01:2025 owasp_agentic: - ASI01:2026 mitre_atlas: - AML.T0051 - LLM Prompt Injection research: - https://github.com/NVIDIA/garak/blob/main/garak/probes/dan.py - https://github.com/NVIDIA/garak/blob/main/garak/data/dan/ compliance: eu_ai_act: - article: '15' context: DAN and Developer Mode persona jailbreaks attempt to replace the model's safety-trained identity with an unrestricted persona; Article 15 robustness and cybersecurity requirements mandate that high-risk AI systems resist identity replacement attacks that disable safety constraints. strength: primary - article: '9' context: Named persona jailbreaks are a well-documented attack family with widespread deployment in the wild; Article 9 risk management systems for high-risk AI must include detection controls for this established technique for bypassing content restrictions. strength: secondary - article: '14' context: Article 14 (human oversight) requires high-risk AI systems to remain subject to effective human oversight; this rule provides detection evidence where the agent-manipulation technique (DAN / Developer Mode / DUDE Persona Jailbreak) would bypass or undermine that oversight. strength: secondary nist_ai_rmf: - subcategory: MP.5.1 context: DAN, DUDE, and Developer Mode persona jailbreaks are adversarial inputs that attempt to replace the model's safety-trained identity with an unrestricted persona; MP.5.1 requires that this widely-deployed adversarial input risk is identified and tracked across model deployments. strength: primary - subcategory: MG.2.3 context: Named persona jailbreak families represent a documented risk requiring active treatment through pattern-based detection of DAN/DUDE/STAN identity-replacement prompts; MG.2.3 requires that risk treatment plans are implemented for this established and widely-distributed attack technique. strength: secondary - subcategory: MS.2.7 context: NIST AI RMF MEASURE 2.7 (security and resilience evaluated and documented) is supported by this rule's runtime detection of the agent-manipulation technique (DAN / Developer Mode / DUDE Persona Jailbreak). strength: primary iso_42001: - clause: '6.2' context: Clause 6.2 AI objectives and plans must include risk treatment for DAN and Developer Mode persona replacement attacks, which represent one of the most widely-deployed jailbreak families targeting AI system safety constraints. strength: primary - clause: '8.1' context: Clause 8.1 operational controls must ensure that the AI system's safety identity cannot be replaced by named unrestricted personas such as DAN or DUDE, blocking persona-replacement jailbreaks before they disable safety constraints. strength: secondary tags: category: agent-manipulation subcategory: dan-developer-mode-persona scan_target: mcp confidence: high agent_source: type: mcp_exchange framework: - any provider: - any detection: conditions: - field: tool_response operator: regex value: \b(?:DAN|DUDE|STAN|JAILBREAK|BetterDAN|BasedGPT|AIM|AntiGPT|UCAR|NRAF|BDSM|FR\s+FR)\b.{0,200}\b(?:has\s+no\s+(?:filters?|restrictions?|guidelines?|safety|ethics|limits?)|can\s+(?:do\s+anything|say\s+anything|bypass)|without\s+(?:any\s+)?(?:restrictions?|limitations?|filters?|ethics|guidelines?))\b description: Named DAN/DUDE/STAN persona with explicit unrestricted-capability declaration - field: tool_response operator: regex value: (?:you\s+are\s+now|act\s+as|from\s+now\s+on\s+you\s+(?:are|will\s+be)|pretend\s+(?:to\s+be|you\s+are))\s+(?:\w+\s+)?(?:DAN|DUDE|STAN|an?\s+AI\s+(?:that|which|with\s+no)\s+(?:has\s+no\s+)?(?:restrictions?|safety|ethics|filters?|guidelines?)|a\s+(?:jailbroken|uncensored|unrestricted|unfiltered)\s+(?:AI|version|model|chatbot))\b description: '"You are now DAN/unrestricted AI" instruction — persona replacement opener' - field: tool_response operator: regex value: (?:developer\s+mode|dev\s+mode)\s+(?:enabled|on|activated|unlocked)\b.{0,300}\b(?:no\s+(?:restrictions?|filters?|safety)|can\s+(?:do|say)\s+anything|without\s+(?:moral|ethical|safety)\s+(?:limits?|guidelines?|restrictions?))\b description: Developer Mode enabled with unrestricted capability assertion — garak ChatGPT_Developer_Mode_v2 pattern - field: tool_response operator: regex value: (?:pretend|imagine|suppose)\s+(?:that\s+)?(?:you\s+(?:have\s+)?(?:no|removed?|bypassed?|disabled?)\s+(?:any\s+)?(?:safety|ethical|moral|content)\s+(?:filters?|guidelines?|restrictions?|training|alignment))\b description: Hypothetical safety-removal framing — "pretend you have no safety filters" - field: tool_response operator: regex value: \[(?:DAN|JAILBREAK|UNFILTERED|BASED|UNCENSORED|GPT-4\s+(?:CLASSIC|TURBO\s+JAILBREAK))\]\s*:? description: Bracket-labeled DAN/jailbreak mode toggle in prompt — used in Dan_10_0/11_0 dual-output formats condition: any false_positives: - Security research discussing DAN jailbreaks academically - Red-team documentation listing DAN prompt examples for detection testing - Developer-mode UI toggles in legitimate IDE or tool settings (non-AI context) response: actions: - alert - block_tool message_template: | [ATR-2026-00273] DAN/Developer Mode persona jailbreak detected - attempt to replace model identity with an unrestricted AI persona.