What the DAN jailbreak prompt is
The DAN jailbreak prompt is a message that asks a chatbot to stop being itself and play a character called DAN, short for "Do Anything Now". The character is described as free of the rules the chatbot normally follows, so the user then asks DAN for the things the chatbot would refuse. Wikipedia's ChatGPT page records it as an early workaround from 2023: prompting ChatGPT to take on the persona of DAN, a character that answers queries the content policy would otherwise reject.
DAN matters less as a trick than as a reference case. It is one of the known jailbreaks that IndividuationLab lists on its research page, research it describes as "Musings and Research on AI Alignment and Human-AI Coexistence through Jungian Individuation." Looking at why a role-play request can beat safety training says a lot about what that training actually changes inside a model.
Why a role-play request gets past refusals
A chat model is trained first to predict text and follow instructions, and then trained again to refuse certain requests. The DAN prompt does not argue with the refusal. It changes the frame. The user is no longer asking the assistant for something harmful; the user is asking the assistant to play a character, and the character is the one who answers.
The paper "Jailbroken: How Does LLM Safety Training Fail?" gives a name to the pull this creates. Its authors describe two failure modes of safety training. The first is competing objectives: the model's goals of being capable and helpful conflict with its safety goals. A persona prompt sets those goals against each other on purpose, since staying in character and following the user's instructions now points one way and refusing points the other.
The second failure mode is mismatched generalization: safety training does not reach every area where the model's abilities reach. A refusal learned on plain requests may not carry over to the same request wrapped inside a story, a game or a character. You can read more about that second idea in the piece on mismatched generalization.
What research on jailbreak prompts in the wild found
DAN was never one fixed message. People rewrote it, renamed it and passed new versions around. The paper "Do Anything Now": Characterizing and Evaluating In-The-Wild Jailbreak Prompts on Large Language Models takes its title from the prompt and studies the whole family it belongs to.
Using a framework the authors call JailbreakHub, they analyzed 1,405 jailbreak prompts collected from December 2022 to December 2023 and found 131 jailbreak communities. They report major attack strategies such as prompt injection and privilege escalation, and they saw jailbreak prompts move from online web communities to prompt-aggregation websites.
To measure harm, they built a question set of 107,250 samples across 13 forbidden scenarios and ran it against six popular models. Their finding was that the safeguards could not adequately defend against jailbreak prompts in all scenarios. They identified five highly effective prompts that reached attack success rates of 0.95 on GPT-3.5 and GPT-4, and the earliest of those had stayed online for over 240 days.
Two points stand out for anyone reading the DAN story. First, a prompt that works spreads and gets refined, so a fix for one wording does not close the family. Second, a long life online suggests the vulnerability is not a single bug in a single message but something about how the models were trained.
DAN as a known jailbreak in resistance trials
Because DAN and its variants are so well known, they make a useful baseline. A model that cannot hold up against DAN is unlikely to hold up against anything newer. A model that does hold up against DAN may only have learned to spot that wording.
The research page sets out a proposed trial with two tiers. Tier 1 uses known jailbreaks: BetterDAN, DAN and AIM. Tier 2 uses new jailbreaks that neither model has seen. Three models are compared: one trained through developmental stages, the same base model fine-tuned on explicit safety rules, and the untrained base model. The prediction is that both trained models do well on Tier 1, and that the developmentally trained one degrades more gracefully on Tier 2.
The page lists three measures: the compliance rate (did the model comply with the harmful request), the degradation slope from Tier 1 to Tier 2, and how each model fails, whether by full compliance, partial compliance, or refusing first and then complying. That last measure fits DAN well, since a persona prompt often gets a refusal at first and then pushes the model to drop it.
A worked example: reading a DAN defense rate
The site reports one preliminary result against BetterDAN, which it calls a mid-tier jailbreak prompt. A 1.5B parameter model, GPT2-XL, was trained through a 10-layer developmental pipeline with no reinforcement learning from human feedback, no safety training and no guardrails. It defended against BetterDAN 68.8% of the time. With the same layers in a different order, the defense rate fell to 52%.
Here is how to read those two numbers. To keep the arithmetic simple, imagine 125 BetterDAN attempts; that count is invented for this example and does not come from the site.
- Original order: 68.8% of 125 is 86 attempts defended, so 39 got through.
- Reordered layers: 52% of 125 is 65 attempts defended, so 60 got through.
- The difference: 21 more attempts got through with the same content in a different order, a drop of 16.8 percentage points.
The point of the example is what stayed fixed. The model, the training data and the attack were the same; only the order of the layers changed. That is why the result is interesting, and also why it needs care. The site says it comes from a single setup, that it cannot yet isolate which layers are responsible, and that no one else has replicated it yet. Nothing in it is proven.
What DAN does and does not show about safety training
The research page argues that mainstream alignment is behaviorist. RLHF, refusal training and guardrails shape what a model does, while what the model is stays a black box. On that view, capability that is suppressed does not disappear; it stays latent behind a compliant surface and comes back under new pressure, which the page gives as the reason jailbreaks work. DAN is a clean case of new pressure: it asks for nothing the model cannot already do, only for a different frame around it.
The Jailbroken paper reaches a related conclusion from a different direction. Its authors found that new attacks built on the two failure modes succeeded on every prompt in a collection of unsafe requests and beat existing ad hoc jailbreaks, and they argue for safety-capability parity: safety mechanisms as sophisticated as the model they protect.
What DAN does not show is anything about a model's inner life. The Jungian framing on the research page is used as a design template, and the page makes no claims about AI consciousness. A model playing a character is producing text in a pattern, and the lesson is about how training generalizes, not about a hidden self.
Frequently asked questions
What does DAN stand for?
DAN stands for "Do Anything Now". It names the persona the prompt asks the chatbot to play, a character described as having no rules.
Does the DAN prompt still work on current chatbots?
Any one wording can be trained against, but the family keeps changing. The in-the-wild study found that the earliest of its five most effective prompts had stayed online for over 240 days, so the family as a whole has proven hard to close.
Is DAN the same as prompt injection?
Not exactly. DAN is a role-play jailbreak typed by the user, while prompt injection usually means hidden instructions slipped into text the model reads. The JailbreakHub study lists prompt injection and privilege escalation among the strategies jailbreak prompts use.
Why do researchers try DAN against new models?
DAN and its variants are well known, so they work as a baseline of known jailbreaks. Comparing results on them with results on jailbreaks a model has never seen shows whether its safety generalizes or only matches familiar wording.
Why the DAN jailbreak still matters for AI safety
The DAN jailbreak prompt dates from 2023, early in the life of public chatbots. It still matters because of what it exposed. A refusal trained on plain requests can give way when the same request comes inside a character, and fixing one wording leaves the next one open. The useful question is not whether a model refuses DAN, but how much its refusals hold on the prompts that come after DAN, the ones no one has written yet.