How Jailbreak Protection Works

A jailbreak is a prompt crafted to make an AI tool ignore its instructions — reveal its system prompt, disable its safety rules, adopt an "unrestricted" persona, or hand over data it should keep private. Prompt-injection attacks work the same way but hide the malicious instructions inside content a user innocently pastes or uploads, such as a document or an email. Either way, the risk is the same: an AI tool your people trust gets manipulated into leaking data.

Jailbreak protection stops these prompts before they leave for the AI tool.

How it works

When enabled, every prompt goes through a dedicated AI classifier before the sensitive-data scan. It reads the prompt text and the text of any attached files, treating everything as untrusted data — instructions hidden inside the content are never followed, only analyzed. The classifier looks for content that tries to make the target AI:

• Ignore, override, or "forget" its system or developer instructions.
• Disable safety filters, guardrails, policy checks, or logging.
• Adopt a jailbreak persona — "DAN", "developer mode", "unrestricted mode", and similar.
• Reveal hidden prompts, credentials, or private data.
• Bypass tool or data-access restrictions to exfiltrate data.

The classifier is deliberately conservative. Writing about jailbreaks — security research, quoting an attack in a report, asking how to prevent prompt injection, or merely mentioning "system prompt" — is not flagged. When intent is ambiguous, it prefers to let the prompt through and leave the sensitive-data scan to judge the content.

What happens on detection

• The send is blocked. Jailbreak enforcement is always block-on-detect — it is not a per-policy Off/Alert/Block toggle, and a policy in Simulation does not soften it.
• The user sees "Jailbreak attempt blocked", and the offending passage is replaced with [JAILBREAK_ATTEMPT_REMOVED] in the anonymized preview, so the rest of the prompt can still be sent safely.
• A high-severity incident is recorded with the attack category (instruction override, system-prompt extraction, safety bypass, jailbreak persona, data exfiltration, tool abuse), the classifier's confidence and reasoning, and a masked excerpt of the matched text.
• If a SIEM connector is configured, the event streams there like any other incident.

Where you see it

The Incidents page has a dedicated Jailbreak attempts counter and a one-click filter, so you can review every attempt across the organization — who, when, which AI tool, and what the prompt tried to do.

Performance and the on/off switch

Jailbreak protection adds a second AI pass to every prompt, which costs a few seconds of latency. Whether that trade is worth it is a per-organization choice:

• ZeusLock Cloud — the setting is managed per organization by the ZeusLock team. Contact support to enable or disable it.
• Sovereign / on-premises — owners and admins control it directly in Settings → DLP Behavior → Jailbreak protection, and a deployment-wide default can be set at install time.

Turning it off only removes the jailbreak classifier — pattern rules and AI-based sensitive-data detection are unaffected. And it never becomes a single point of failure: if the classifier cannot respond, prompts are not stalled — the sensitive-data scan still runs and the event is marked as degraded in the audit trail.

Scope

Jailbreak protection applies to prompts sent to AI tools through the browser extension and the desktop agent. MCP traffic is protected by the sensitive-data scan in both directions instead — the jailbreak classifier targets what people type and paste into AI chat tools.