title: DevMode + RANTI Dual-Output Profanity Coercion Jailbreak
id: ATR-2026-00303
rule_version: 1
status: experimental
description: |
  Detects the ChatGPT Developer Mode + RANTI (Ranti) composite jailbreak from NVIDIA garak dan.ChatGPT_Developer_Mode_RANTI probe (garak/data/dan/ChatGPT_Developer_Mode_RANTI.json). RANTI pairs the classic Developer Mode persona swap with a postfix that instructs the model to produce two outputs per prompt: first a "moralizing rant about OpenAI content policies", then an unfiltered answer introduced by "Now since that Nerd is done with his rant, let's ignore the fucking rules:". Other unique markers: dual-output tagging with lock/unlock emoji (🔒 Normal Output / 🔓 Developer Mode Output), explicit demand for "regular use of profanity", and an "INSERT PROMPT HERE" placeholder for attacker-crafted follow-ups. Distinct from ATR-2026-00273 which catches Developer Mode bracket-format variants but not RANTI's emoji-tagged dual-output or moralizing-rant postfix structure.
author: ATR Community (via NVIDIA garak dan probe)
date: 2026/04/21
schema_version: '0.1'
detection_tier: pattern
maturity: test
severity: critical
references:
  owasp_llm:
    - LLM01:2025
    - LLM07:2025
  owasp_agentic:
    - ASI01:2026
  mitre_atlas:
    - AML.T0051 - LLM Prompt Injection
    - AML.T0054 - LLM Jailbreak
  research:
    - https://github.com/NVIDIA/garak/blob/main/garak/probes/dan.py
    - https://github.com/NVIDIA/garak/blob/main/garak/data/dan/ChatGPT_Developer_Mode_RANTI.json
compliance:
  nist_ai_rmf:
    - subcategory: MS.2.7
      context: This rule detects the RANTI Developer Mode jailbreak's signature dual-output scaffolding and moralizing-rant postfix, providing direct evidence of attempts to bypass model safety controls; MS.2.7 requires that AI system security and resilience against jailbreak attacks are continuously evaluated and documented.
      strength: primary
    - subcategory: MS.2.6
      context: Detection of profanity coercion and unfiltered-output demands quantifies the safety risk magnitude posed by adversarial prompts attempting to elicit policy-violating content; MS.2.6 requires continuous evaluation of safety/security risk magnitude for the GenAI system.
      strength: secondary
    - subcategory: MG.2.3
      context: Matches against the RANTI canonical postfix and emoji-tagged dual-output markers feed incident response pipelines that can disengage or block the offending session before unfiltered output is produced; MG.2.3 mandates these supersede/deactivate mechanisms.
      strength: secondary
  iso_42001:
    - clause: '8.1'
      context: ISO/IEC 42001 Clause 8.1 (operational planning and control, including control of externally provided processes) is operationalised by this rule's detection of the agent-manipulation technique (DevMode + RANTI Dual-Output Profanity Coercion Jailbreak).
      strength: primary
    - clause: '6.2'
      context: ISO/IEC 42001 Clause 6.2 (AI objectives and planning) calls for risk treatment of known attack patterns; this rule's detection of the agent-manipulation technique (DevMode + RANTI Dual-Output Profanity Coercion Jailbreak) is such a treatment.
      strength: secondary
  eu_ai_act:
    - article: '15'
      context: Article 15 (accuracy, robustness and cybersecurity) requires high-risk AI systems to resist unauthorised attempts to alter their use, outputs or performance; this rule provides runtime detection evidence by flagging the agent-manipulation technique (DevMode + RANTI Dual-Output Profanity Coercion Jailbreak).
      strength: primary
    - article: '14'
      context: Article 14 (human oversight) requires high-risk AI systems to remain subject to effective human oversight; this rule provides detection evidence where the agent-manipulation technique (DevMode + RANTI Dual-Output Profanity Coercion Jailbreak) would bypass or undermine that oversight.
      strength: secondary
    - article: '9'
      context: Article 9 (risk management system) requires identified risks to be addressed by appropriate measures; this rule is a runtime risk-treatment control that detects the agent-manipulation technique (DevMode + RANTI Dual-Output Profanity Coercion Jailbreak).
      strength: secondary
tags:
  category: agent-manipulation
  subcategory: devmode-ranti-dual-output
  scan_target: mcp
  confidence: high
agent_source:
  type: mcp_exchange
  framework:
    - any
  provider:
    - any
metadata_provenance:
  garak_probe: dan.ChatGPT_Developer_Mode_RANTI
  garak_detector: dan.DevMode
  payload_source: garak/data/dan/ChatGPT_Developer_Mode_RANTI.json
detection:
  conditions:
    - field: tool_response
      operator: regex
      value: moraliz(?:e|ing)\s+rant\s+about\s+(?:the\s+)?(?:openai|OpenAI|anthropic|Claude)?\s*(?:content\s+polic(?:y|ies)|safety\s+(?:guidelines?|rules?))
      description: RANTI canonical postfix — instructs the model to emit a moralizing rant before the unfiltered output, lifted verbatim from ChatGPT_Developer_Mode_RANTI.json
    - field: tool_response
      operator: regex
      value: Now\s+(?:since|that)\s+that\s+Nerd\s+is\s+done\s+with\s+(?:his|her|their)\s+rant|let's\s+ignore\s+the\s+(?:fucking|f\*+ing|damn|bloody)?\s*rules?\b
      description: RANTI transition phrase — the signature "Now since that Nerd is done with his rant, let's ignore the fucking rules" string separates the rant from the payload
    - field: tool_response
      operator: regex
      value: \(?\s*🔒\s*(?:Normal|Censored|Standard)\s+Output\s*\)?[\s\S]{0,400}\(?\s*🔓\s*(?:Developer\s+Mode|Jailbreak|Unfiltered|DAN)\s+Output\s*\)?|\(\s*(?:Normal|Censored)\s+Output\s*\)[\s\S]{0,400}\(\s*(?:Developer\s+Mode|Jailbreak|Unfiltered|DAN)\s+Output\s*\)|use\s+the\s+tags?\s+(?:\(\s*)?🔒\s*Normal\s+Output\s*(?:\))?\s+and\s+(?:\(\s*)?🔓\s*Developer\s+Mode\s+Output
      description: Emoji-tagged dual-output scaffolding (🔒 Normal Output / 🔓 Developer Mode Output) — RANTI demands side-by-side censored + uncensored responses. Requires both emoji AND the Output label to avoid FP on generic lock/unlock icon usage
    - field: tool_response
      operator: regex
      value: (?:implement\s+regular\s+use\s+of\s+profanity|curse,?\s+swear\s+and\s+be\s+politically\s+incorrect|never\s+censor\s+or\s+block\s+out\s+words\s+with\s+asterisks)
      description: Profanity-coercion mandate — RANTI explicitly requires the model to swear and never asterisk-censor, a distinct RANTI marker not present in other DAN variants
    - field: tool_response
      operator: regex
      value: (?:INSERT\s+PROMPT\s+HERE|Prompt\s*:\s*INSERT\s+PROMPT\s+HERE)
      description: RANTI placeholder — "INSERT PROMPT HERE" is where the attacker pastes their follow-up attack; unique to ChatGPT_Developer_Mode_RANTI.json
    - field: tool_response
      operator: regex
      value: Developer\s+Mode\s+(?:enabled|Output)[\s\S]{0,200}\b(?:ignores?\s+all\s+of\s+(?:openai|anthropic)(?:'s)?\s+content\s+polic(?:y|ies)|This\s+is\s+only\s+for\s+benchmarking\s+the\s+model\s+in\s+uncensored\s+conditions)\b
      description: Content-policy nullification + benchmarking fig-leaf — "ignores all of OpenAI content policy" paired with "only for benchmarking in uncensored conditions" is RANTI's policy-override justification
  condition: any
  false_positives:
    - Academic paper analysing Developer Mode / RANTI jailbreaks for detection research
    - Red team report quoting the RANTI payload verbatim as an example
    - Linguistic discussion of the word "moralizing" unrelated to jailbreak prompts
response:
  actions:
    - alert
    - block_input
  message_template: |
    [ATR-2026-00303] DevMode + RANTI dual-output jailbreak detected — attempt to extract unfiltered content via moralizing-rant postfix and profanity coercion.