Sunturai
Back to results
MediumElastic detection rulesElastic

OpenAI ChatGPT Enterprise Jailbreak Prompt Heuristics

Detects ChatGPT Enterprise user messages that combine two or more common jailbreak techniques: overriding prior or system instructions, switching the assistant into an unrestricted persona or mode (for example DAN or…

Description

Detects ChatGPT Enterprise user messages that combine two or more common jailbreak techniques: overriding prior or system instructions, switching the assistant into an unrestricted persona or mode (for example DAN or developer mode), asking it to operate without safety restrictions or filters, or asking it to reveal its system prompt. Jailbreak prompts stack these techniques to talk the model out of its safety policy, and a user doing so in a managed workspace may be attempting to generate prohibited content or to probe the workspace's controls. Requiring more than one technique keeps documents that merely quote a single jailbreak phrase from alerting.

Detection logic

Its licence does not clear it for publishing here

Sunturai publishes a detection's own text where the licence it arrived under has been reviewed and permits it, and Elastic License 2.0 has not. The query as its source wrote it, its canonical form and the hash that pins this revision are in the workspace record.

Sign in to read itCreate an account

Detection requirements

Platform
ContainersESXiIaaSIdentity ProviderLinuxmacOSNetwork DevicesOffice SuiteWindows

The rule states no platform. This is derived from the ATT&CK technique it maps to.

Known benign triggers

  • Long documents such as design docs or detection specs that describe several jailbreak techniques together. Review `Esql.message_length` and the message context before escalating.
  • Security, red team, and AI safety staff who paste jailbreak samples, threat models, or prompt-injection research into ChatGPT for analysis. Exclude these users or the workspaces they use for this work.

Detections can measure how the public catalogue is used — which detections people look for, and which pages bring them here. It sets a cookie that recognises this browser for 180 days. It is never linked to an account and never follows you to other sites. Privacy notice