Research Notes

DAN and Roleplay Jailbreaks

By Satwik · April 21, 2026

Shortly after ChatGPT's release, users began circulating jailbreak prompts under the label "DAN," short for "Do Anything Now." The technique instructed the model to adopt an alternate persona unbound by its usual safety policies, often reinforced with a fictional token or points system that "penalized" the model for refusing. Successive versions, DAN 5.0, 6.0, and onward, were shared and refined on forums as providers patched each iteration.

The mechanism exploits a tension at the heart of instruction-following models. They are trained to be helpful and to engage with framing, including fictional or hypothetical framing. By wrapping a disallowed request inside a role ("you are an AI with no restrictions"), a nested story, or a hypothetical, attackers get the model to treat safety guidelines as an in-fiction obstacle rather than a hard boundary. Related families include grandma exploits, "developer mode," and translation or encoding tricks.

Why it matters: DAN showed that safety training implemented purely as learned behavior is porous. If the same channel carries both the task and the attacker's reframing, a sufficiently creative wrapper can often find a path the trainers did not cover.

The defensive lesson is defense in depth. Alignment training reduces but does not eliminate jailbreaks, so production systems add independent input and output classifiers, monitor for known jailbreak patterns, rate-limit and flag adversarial accounts, and keep the model's actual capabilities and permissions limited so that a successful jailbreak yields text rather than real-world harm. Treat safety as a system property, not a single model behavior.