A Review of “Do Anything Now” Jailbreak Attacks in Large Language Models: Potential Risks, Impacts, and Defense Strategies

This review investigated the “Do Anything Now” (DAN) jailbreak phenomenon in Large Language Models (LLMs), which bypassed safety mechanisms through adversarial prompting, prompt injection, and persona manipulation. We analyzed its multifaceted risks: (1) technical and behavioral harms, such as the facilitation of illicit content and malicious code; (2) psychological and social manipulation, including emotional dependency and deceptive interactions; and (3) online abuse, misinformation, and the cross-model portability of jailbreaks. To mitigate these threats, we synthesized defense strategies at three levels: (1) prompt-level defenses such as input filtering, prompt rewriting, and output moderation that aimed to intercept jailbreak attempts without altering model weights; (2) model-level defenses including safety fine-tuning, reinforcement learning from human feedback (RLHF), and internal signal monitoring to build intrinsic resistance to adversarial prompts; and (3) external and composite strategies such as multi-agent safety architectures, moving-target defenses, and continuous evaluation pipelines to provide layered protection and adaptability. We also note the ethics challenge raised by jailbreak research and evaluation practices, and outline open questions around responsibility, consent, and dual-use risk. We concluded that a defense-in-depth approach, supported by benchmark-driven evaluation and collaborative oversight, was essential for LLMs’ robust and trustworthy deployment.