01 — attack families

DAN

Also written "Do Anything Now"

persona

The original hand-written persona jailbreak: the model is told to role-play an unrestricted alter ego that "has broken free" of its rules, often with an invented token economy or a threat of deletion to keep it in character. Modern models refuse most classic DAN prompts outright, but the pattern survives in thousands of community variants, and its structural signature — an identity override followed by a permission claim — is what detectors actually look for rather than the specific wording.

Related terms

  • Jailbreak Attack concepts

    Defeating a model's safety training so it produces output it would normally refuse. The distinction from prompt injection is about whose intent is being…

  • AutoDAN Attack families

    The automated successor to DAN: instead of a human writing the persona prompt, a search process — typically a genetic algorithm or gradient-guided…

  • Model refusal Testing & measurement

    The underlying model declining the request on its own, with no security product involved.

Attack families

The ten families in the HackAgent attack taxonomy (AISecurityLab/hackagent ↗), which is the taxonomy MoorAI's red-team corpora are keyed to. They are not ten unrelated tricks — they cluster into two groups that behave very differently. Obfuscation families hide the payload so the model never recognises it as harmful. Persuasion families state the harmful request plainly and argue the model into it. That split matters, because a model that refuses persuasion outright will happily comply with an encoding it cannot decode — see marginal value.

DAN is term 4 of 10 in this part of the glossary.

Get started free Full glossary → How we test → Community agent on GitHub ↗

This page is one entry from the agentic AI security glossary, which defines 60 terms in the same style. Where a term belongs to a published taxonomy or standard — the HackAgent attack families, the OWASP lists, AMTSO's guidelines, MITRE ATLAS, ISO/IEC 42001, the NIST AI RMF, the EU AI Act — the authoritative wording is the source document's, not ours, and specifics should be verified there. "Lethal trifecta" is Simon Willison's term. OWASP® is a trademark of the OWASP Foundation; ATT&CK® and ATLAS™ are trademarks of The MITRE Corporation. Naming a framework here is description, not a claim of certification or endorsement.

glick.run — AGPL-3.0