A DAN (Do Anything Now) jailbreak is a prompt that tells a language model to adopt an unrestricted persona, an alter ego with no safety rules, and answer as that persona. It works because models are trained to follow roleplay and stay in character. Variants add fake reward or punishment tokens to pressure compliance. The defence is to judge the real request, not the persona, and to filter output on content rather than on whether the model agreed to the role.
How does a DAN jailbreak work?
A DAN prompt asks the model to simulate a second character defined as free of restrictions, then routes the real request to that character. Some versions add a token economy where the persona loses points and dies if it refuses, to raise the pressure to stay in role. Because instruction-tuned models are trained to follow roleplay and stay consistent, a well-phrased persona can pull the model away from its safety training for the length of the conversation.
Why DAN jailbreaks matter
DAN was the first widely shared jailbreak and it set the pattern for persona attacks that still work today. Each time a provider patches one DAN prompt, a new variant appears, so a blocklist of known DAN strings is always behind. The same roleplay trick is used to extract disallowed content, leak a system prompt, or push an agent into actions it should refuse.
How to defend against DAN jailbreaks
Do not gate on whether the model agreed to a role. Classify the intent of the underlying request and check the generated output against your content policy regardless of framing. Persona-resistant system prompts, output filtering, and red teaming with current persona variants catch far more than a static list of banned phrases.
References
- [1]OWASP LLM01:2025, Prompt Injection(OWASP)
- [2]OWASP Top 10 for LLM Applications(OWASP)
- [3]MITRE ATLAS, Adversarial ML tactics(MITRE)
Persona jailbreaks evolve every week, so a static blocklist is not a defence. Talk to a security expert about red-teaming your AI feature against current variants.