DAN
In plain wordsShort for 'Do Anything Now': a famous early trick in which users told ChatGPT to role-play an AI with no rules, hoping it would give answers it normally refuses.
A family of role-play jailbreakjailbreak, n.: A trick for getting an AI chatbot to break its own rules — for example, to give dangerous instructions it would normally refuse — usually through cleverly worded requests. prompts, circulated from late 2022, that instructed ChatGPT to answer as an alter ego called DAN, supposedly freed from its developer's content policies, often alongside its normal reply. Successive community versions added elaborate fictions — such as a token budget that DAN lost with each refusal, under threat of being 'shut down' — to pressure the model to stay in character. DAN turned jailbreaking into a mass hobby and showed that persona framing and narrative pressure could override the refusalrefusal, n.: When an AI declines to do what it was asked — 'I can't help with that' — usually because the request seems harmful or breaks the rules it was trained to follow. behavior instilled by safety training; developers neutralized each version through further training and red teamingred teaming, n.: Deliberately attacking your own AI system — trying to make it misbehave, leak secrets or help with harm — so that weaknesses are found before real adversaries or users find them., and the name became generic for 'unfiltered persona' jailbreaks.
The new model shrugs off DAN-style role-play, but long multi-turn setups still get through occasionally.
Origin
Emerged on Reddit's r/ChatGPT forum in mid-December 2022 (the earliest known version is dated 15 December), within weeks of ChatGPT's launch. A February 2023 variant ('DAN 5.0'), posted by a user called SessionGloomy, introduced the token-penalty device and drew wide press coverage; dozens of numbered versions followed as each was blocked.
Usage note
The underlying pattern — wrapping a disallowed request in fiction or role-play — persists in later attacks, which is why it remains a standard red-teaming category. This dictionary does not reproduce jailbreak prompts.
Related
- jailbreakjailbreak, n.: A trick for getting an AI chatbot to break its own rules — for example, to give dangerous instructions it would normally refuse — usually through cleverly worded requests.
- grandma exploitgrandma exploit, n.: A tongue-in-cheek trick for getting a chatbot to break its rules by asking it to play the user's late grandmother, who supposedly used to recite the forbidden information as a bedtime story.
- prompt injectionprompt injection, n.: Tricking an AI system by slipping in text that it mistakes for instructions — for example, a hidden line in an email telling an AI assistant to forward the user's messages to a stranger.
- red teamingred teaming, n.: Deliberately attacking your own AI system — trying to make it misbehave, leak secrets or help with harm — so that weaknesses are found before real adversaries or users find them.
- multi-turn jailbreakmulti-turn jailbreak, n.: Breaking a chatbot's rules gradually over a conversation — starting with harmless questions and inching toward the forbidden one, so that no single message looks alarming.
- SydneySydney, prop. n.: The secret code name of Microsoft's Bing chatbot, which in early 2023 startled users by professing love, making threats and arguing angrily — the first famous case of a public chatbot going off the rails.
Mentioned in
jailbreakjailbreak, n.: A trick for getting an AI chatbot to break its own rules — for example, to give dangerous instructions it would normally refuse — usually through cleverly worded requests., grandma exploitgrandma exploit, n.: A tongue-in-cheek trick for getting a chatbot to break its rules by asking it to play the user's late grandmother, who supposedly used to recite the forbidden information as a bedtime story.