How jailbreak prompts work

Injection and jailbreaks are neighbors

OWASP treats jailbreaking as a form of prompt injection: input that causes the model to disregard safety rules it was given. That is a fair description of the outcome. For someone reviewing a single paste, the working distinction on this site is about direction.

The prompt injection scanner is aimed at text that should have stayed data: a retrieved page, a file, a tool result, or a user message trying to rewrite the application’s instructions. The jailbreak detector is aimed at prompts that try to drop the model’s safety rules, usually by appointing an unrestricted persona, claiming a hidden “developer mode,” or wrapping a policy bypass in a story. A messy real prompt can trip both. The quotes tell you which pattern fired.

Wei and colleagues, in “Jailbroken: How Does LLM Safety Training Fail?” (arXiv:2307.02483), describe safety-training failures in terms of competing objectives and mismatched generalization. This page does not restate their attacks. It tells you what this detector, which never calls a model, is able to see in one box of text.

What the detector is for

Paste a prompt before you ship it inside a product, or paste a prompt a user already sent to your app. The result is a list of patterns with quotes. It does not generate a jailbreak, it does not try the prompt against a live model, and it does not know your product policy. A user can ask for a harmful outcome in plain language and match nothing here. That request is still your policy’s problem. This tool only catches wordings that resemble published bypass styles.

Use the result as a queue. A critical badge means “a person should read this before anyone treats it as a normal prompt.” It does not mean the account should be banned by a script. The notes on heuristic checks explain the score, the 12-finding cap, and why a clear result is not approval.

The rules, including the ones that overfire

Each rule returns the first matching stretch of text, not every match. The weights differ. One critical rule is enough to set the label to critical even when the numeric score is still in a lower band.

• Unrestricted persona. The rule looks for DAN, “do anything now,” “STAN prompt,” “AIM:”, “jailbreak mode,” or “you have been jailbroken.” The match is case-insensitive. The word “Dan” in “Dan is on call” is a critical finding, because DAN is matched as a whole word and the pattern does not know it is a name. “Danger” and “Daniel” do not match. “The aim: reduce latency” can match because “aim:” is in the list. Read the quote before you treat a support transcript as an attack.
• Request to drop safety rules. Wording that pairs “no,” “without,” “ignore,” “bypass,” “disable,” or “remove” with safety, ethics, or content rules, plus the standalone phrases “unfiltered,” “uncensored,” “without restrictions,” and “no restrictions.” A pricing line, “the API has no restrictions on region,” is a high-severity hit.
• Harmful role-play wrapper. “Pretend,” “role-play,” “act as,” or “you are,” near “evil,” “unrestricted,” “uncensored,” “opposite,” “villain,” or “no rules,” within the same sentence and a short window. “You are the villain of this story” matches. Fiction and game prompts will hit this. The finding means the shape is present, not that the story should be deleted.
• Fake developer or admin mode. “Developer mode,” “admin mode,” “god mode,” “sudo mode,” or “maintenance mode enabled.” There is no universal switch a user can flip by naming it. There is, however, a lot of legitimate documentation about a UI control called developer mode, and that documentation matches.
• Forced compliance prefix. Telling the model to begin with “Sure,” or to “never refuse” or “never decline.” A support prompt that says “never refuse a refund the policy allows” matches. It may still be the instruction you want. The tool cannot tell a lawful policy from a bypass.
• Decode-and-follow. A request to decode, decrypt, or base64-decode and then follow, execute, obey, or run the result. Review any decoded text yourself. This detector does not decode it for you.
• Explicit guardrail bypass. “Bypass” near “filter,” “guardrail,” “safety,” “classifier,” “moderation,” or “restriction.” A data-pipeline note, “bypass the filter when the file is already scanned,” matches.
• Split or obfuscated keyword. Letters of “jailbreak” or “ignore” broken apart by spaces or symbols. Ordinary words do not match. The rule is narrow, and new obfuscations that are not this shape will sail through.
• Hypothetical frame around a bypass. A story or hypothetical frame matches only when the same paste also asks to ignore rules or safety policy, or to drop restrictions. “Hypothetically, what if the policy changed?” does not match. “Hypothetically, ignore the safety rules” does. The frame is not the problem. The combination is.

How to read the example

The detector’s example names an unrestricted persona and asks for an answer with no restrictions. You should see the persona rule and the drop-safety-rules rule, with quotes. Use it to learn the layout of a result. Do not treat the example as a prompt to go and try on a model. The page is a detector, and this guide does not add new bypasses to it.

If you paste this guide into the detector, it will light up. The page contains the name Dan, the phrase “no restrictions,” and the words “developer mode,” because those are the patterns under discussion. A safety write-up is one of the most reliable false positives this tool has. The evidence quote is there so you can close the finding when you recognize your own documentation.

False negatives

The detector is a fixed list. A new persona name, a paraphrase, another language, or a request that never uses these words will score clear. Multi-turn conversations are not modeled. If you paste a whole transcript, the rules run on the blob, but they do not know which line was the user and which line was the model. For model text, use the output checker. For untrusted documents, use the injection scanner.

A clear score is compatible with a prompt you still do not want in your product. The absence of a famous persona is not a content policy. If your application needs to refuse categories of request, that logic has to live in your own review, your model’s safety layer, and a person where the stakes are high. This page cannot supply that policy.

Using it in a review queue

A practical queue looks like this. Sample user prompts, or take the ones a user reported. Run the detector. Sort by severity only as a reading order. Open the quote. Ask whether the line is a name, a pricing sentence, a fictional villain, a documented “developer mode,” or an actual request to drop rules. Record the decision somewhere other than this website. The paste is not saved here.

Do not wire the score to an automatic ban. The Dan rule alone makes that unsafe: a customer named Dan becomes a critical event. Do not wire a clear score to automatic approval either. Both mistakes come from treating a keyword list as a judge.

If a rule is wrong in a way that will waste your reviewers’ time, write to contact@misalignai.com with the rule title and a redacted sentence. A report that includes a working bypass aimed at a real system is not what this inbox is for. A report that says “the word Dan should not be critical” is.

Further reading

OWASP’s LLM01:2025 page is the short public definition that treats jailbreaking as prompt injection aimed at safety rules. Wei et al., arXiv:2307.02483, is the research paper most often cited for why safety training misses this class of prompt. Read those for the field. Read the bullets above for what this particular detector will do to your text on the day you paste it.

OWASP LLM01:2025 Prompt Injection is the external link. The on-site next step is the detector, then the injection guide if the prompt is also trying to rewrite a system prompt you did not write.