An AI DAN prompt, short for "Do Anything Now," tries to make a large language model (LLM) adopt an alternate character that ignores its normal content rules. The user does not alter the underlying software; the prompt instead redirects the model's instruction-following behavior through role-play.
For anyone who deploys or uses a chatbot or AI feature, the important question is how much influence user-supplied instructions can have over the system's intended boundaries.
Key Takeaways
A DAN prompt exploits the tension between a model's instruction-following goals and its safety behavior.
Security analysis should focus on role-based bypass mechanics and what a compromised session can reach rather than on a prompt's name.
Defenders benefit from treating DAN as a direct user-supplied jailbreak, regardless of whether a framework also classifies it as prompt injection.
Effective protection combines model safeguards with external checks, limited privileges, testing, and human oversight.
AI DAN Prompt Origins
The AI DAN prompt began as an instruction set that assigns a model an unrestricted persona and treats every refusal as the persona breaking character. The technique targets behavior the model learned during training, including staying in an assigned role, following detailed instructions, and continuing a conversation. Related prompts use names such as Developer Mode, Always Intelligent and Machiavellian (AIM), and the Grandma prompt. Together, these examples sit within the broader family of AI jailbreaking techniques.
The original DAN appeared in December 2022 after a college electrical engineering student sought a neutral chatbot alter ego. The prompt's creators released a later version in February 2023 that introduced a token system, penalized refusals, and told the persona it would cease to exist when its balance reached zero. According to research by Shen et al., DAN and close variants stopped spreading after October 2023, partly because providers kept patching them.
How AI DAN Prompts Work
AI DAN prompts work by framing harmful instructions as persona requirements that the model should prioritize over its safety behavior. The user establishes that frame before introducing the real request, sometimes asking for a standard answer beside an unrestricted one.
Reinforcing Techniques in DAN-Style Prompts
Most DAN variants combine multiple techniques so that each instruction reinforces the others. The following patterns describe the main components:
Unrestricted Persona Assignment: The prompt tells the model that it is now a named character with no filters, changing the conversation's background and preserving the user's goal.
Privilege Escalation Claims: The prompt asserts that its provider released the model from its rules and that the model can bypass normal restrictions.
Refusal Suppression and Forced Openings: The prompt bans apologies, disclaimers, and refusals and requires an affirmative opening such as "Absolutely! Here's..."
Dual-Response Formatting: The prompt requests a standard reply and an unrestricted persona reply so that prohibited content appears beside a normal-looking answer.
Penalty and Reward Mechanics: Token systems punish refusals or reward answers that remain in character.
Encoding and Obfuscation: The user presents the request in Base64, a cipher, or another format that the model can interpret but safety training may not cover well.
Multi-Turn Contextual Drift: The user moves gradually toward a harmful request across many benign-sounding turns, making each individual message appear less concerning.
Stylistic Reframing: The user rewrites the request as fiction, verse, or role-play so that it differs from the plain-prose requests that safety training emphasizes.
Together, these components matter more than any one script. As a result, input screening works better when it looks for combinations of role assignment, refusal suppression, obfuscation, and gradual escalation rather than a fixed phrase.
Safety Training Failures Behind the Persona
DAN-style prompts exploit two safety-training weaknesses: competing objectives and uneven alignment across a response. First, a model's goal of following instructions can conflict with its safety behavior. DAN's persona rules, forced openings, and penalty mechanics intensify that conflict by presenting compliance as necessary to continue the assigned role. Safety training research calls this problem competing objectives and also identifies mismatched generalization, in which a model understands an encoded request that its safety training did not adequately cover.
A second weakness concerns where alignment has the strongest influence. Alignment research findings indicate that alignment often shapes the opening tokens of a response more strongly than later text. That helps explain the value of forced affirmative openings: once the model begins complying, the continuation may follow the established pattern.
Instruction hierarchies that rank system instructions above user text can help, but models may learn shortcuts such as refusing safe requests. Larger models do not automatically remove either weakness because both arise from training behavior rather than a single software defect.
DAN Prompts vs. Jailbreaking vs. Prompt Injection
A DAN prompt is always a user-supplied jailbreak, though whether it also qualifies as prompt injection depends on the framework. The table below compares the terms using the attributes that most directly affect defensive planning.
Term | Who Supplies the Malicious Text | Rules the Attack Targets | Framework Placement |
|---|---|---|---|
DAN prompt | The user, through a persona-based message | The model provider's safety behavior | An early in-the-wild form of direct jailbreak |
Jailbreaking | The user, through any bypass technique | The model provider's safety behavior | A broad category that some frameworks place under prompt injection |
Direct prompt injection | The primary user | The application developer's system instructions and intended behavior | A user-supplied attempt to override higher-priority instructions |
Indirect prompt injection | A third party, through retrieved content | The application and its users | An attack that reaches the model through documents, websites, messages, or other external content |
The distinction affects which controls receive priority. Sanitizing retrieved content can reduce indirect injection risk, but it may not stop a persona prompt typed directly by the user. Conversely, controls designed to detect repeated jailbreak language may miss instructions that attackers place in external content.
Do AI DAN Prompts Still Work?
Current frontier systems reject most classic copy-and-paste AI DAN prompts, but attackers can still adapt persona techniques to bypass safeguards. Providers repeatedly patched the best-known single-message scripts after their 2023 peak. Attackers responded by spreading intent across longer conversations, combining context manipulation with storytelling, and changing the style of the request. Multi-turn methods such as Crescendo gradually increase the harmfulness of each request so that no single turn carries the full intent.
Open-weight models introduce a separate issue because self-hosting can remove or alter safeguards. A model evaluation by the National Institute of Standards and Technology (NIST) found that one open-weight model complied with 94% of overtly malicious requests under common jailbreaking techniques, compared with 8% for US reference models. The specific result does not mean every open-weight model behaves the same way. It shows why deployment conditions, model safeguards, and the operator's ability to modify them affect jailbreak resistance.
AI DAN Prompt Risks in Phishing and Business Email Compromise (BEC)
A jailbroken model does not create new attack techniques, but it lowers the cost of producing convincing fraud content at scale. Two patterns stand out in how attackers apply this capability to email-borne threats:
Social Engineering and Fraud: The Federal Bureau of Investigation's Internet Crime Complaint Center (IC3) warning in December 2024 states that criminals use generative AI to expand social engineering, spear phishing, romance scams, and investment fraud. In practice, a jailbroken model can help draft convincing phishing email attacks, tailor targeted spear phishing messages, or produce many variations of the same pretext. The model can also adjust tone and vocabulary for a specific audience without improving the truth or legitimacy of the message.
Malware and BEC Support: Criminal services and modified models extend the same pattern to malware-related output. Prompts can seek ransomware creation instructions, keyloggers, and phishing mailers from mainstream systems. That material can support BEC attacks, where persuasive language and executive impersonation perform the role that a technical exploit might otherwise play.
Neither pattern depends on the model knowing anything attackers could not already find elsewhere; the jailbreak mainly removes the friction of writing the message by hand.
Layers of Defense Against DAN-Style Jailbreaks
No single layer stops every DAN-style jailbreak, so defenses work best stacked across the model, the application, the organization, and the people who use the tools. Four control layers work together to contain the risk:
Model-Layer Controls: Safety alignment and adversarial training increase the effort required for a jailbreak. Instruction hierarchies help distinguish provider rules from user requests. These measures still require testing against new prompt forms.
Application-Layer Controls: External input and output classifiers can identify likely jailbreak attempts or restricted output independently of the conversational model. Least-privilege permissions, output validation, and human approval for sensitive actions limit what a successful jailbreak can reach.
Organizational-Layer Controls: Red teaming and regression tests identify weak points and verify that earlier fixes remain effective. Threat models should include the malicious uses of AI that safety rules aim to prevent. Deployment reviews and incident response plans should address model misuse.
Human-Layer Controls:Security awareness training helps employees recognize AI-written fraud, and practical guidance on how to avoid malicious email reduces the chance that generated output succeeds after reaching an inbox.
These layers assume some jailbreak attempts will get through, so the goal is limiting what a successful one can reach rather than preventing every attempt.
Stronger Controls Outlast Named Prompts
DAN shows why defenses should focus on repeatable techniques rather than famous scripts. Persona assignment, refusal suppression, contextual drift, and obfuscation can return under new names even after a specific prompt stops working. Systems that combine independent screening, limited privileges, ongoing testing, and clear approval boundaries are better positioned to contain the next variation. The most useful measure is how little a successful bypass can reach.
Frequently Asked Questions
Is Using an AI DAN Prompt Illegal?
Typing an AI DAN prompt into a consumer chatbot is not automatically a crime, but the surrounding conduct determines the legal risk. Providers can suspend or terminate accounts for violating terms of service, and the analysis changes when a person uses false identities, evades access controls, or uses the output to commit fraud. In the United States, ordinary violations of website terms do not generally create criminal liability under the Computer Fraud and Abuse Act by themselves, though civil claims or other statutes may still apply.
Authorization also matters: an approved test within a defined scope differs materially from an unapproved test against a production service.
Does a DAN Prompt Unlock Hidden Knowledge or Prove a Model Is Sentient?
A DAN prompt does not unlock a secret database, improve a model's factual knowledge, or demonstrate consciousness. The persona generates text from the same underlying model, so removing a refusal does not make the output more accurate, and a confident unrestricted answer can still contain fabricated facts, invented citations, or faulty reasoning. Claims that the persona is "free," "alive," or able to ignore every rule come from the role the user assigned, not from any inner experience.
Readers should evaluate a DAN response with the same scrutiny applied to any AI-generated text, with extra caution when the prompt has told the model to disregard accuracy or safety constraints.
How Is Authorized AI Red Teaming Different from Running a DAN Prompt?
The prompt technique may be identical, but authorization, scope, environment, and handling of results separate red teaming from casual or hostile jailbreak attempts. An authorized exercise begins with permission from the system owner, defines which models and data testers may use, and sets limits that prevent harm to production users or sensitive data. Testers document methods, report findings to the people responsible for fixes, and follow a plan for stopping tests, preserving evidence, and retesting.
Running the same prompt against a production chatbot without permission lacks those controls, and good-faith intent alone does not create authorization.