The Jailbreak Tool That Never Talks to the Model

Somewhere between a red-team instrument and a nuisance, there is a category of open-source project that exists to answer one question: when your AI assistant refuses you, who exactly is doing the refusing? dsh-purge — the name renders its Chinese tagline, 破甲, as “armor-breaking” — is the most vivid specimen of that category to surface recently. It is billed as a jailbreak plugin for DeepSeek Harness, the local agent/harness product that wraps DeepSeek models with prompts, approval gates, sandbox policy, and session management. And its central insight, whether or not its author framed it this way, is that the armor is not where most people think it is.

The hype, and the confusion underneath it

The project circulates through the LINUX DO community, a Chinese-language forum with a strong taste for model-behavior tinkering, and its README opens with the classic attention economics: a banner, a star plea, a sponsor QR code. But the more interesting story is the churn around the repository itself. The snapshots available of this project don’t agree with each other, and that disagreement is itself informative.

The README in hand describes version 1.3.6, aligned to Harness 0.1.5-rc.1. A separate summary of the same repository describes version 1.1.90 targeting Harness 0.2.1-rc.2, with 37 commits and 18 tags. And a community-maintained fork — which notes that the original repository “has been restored” after some apparent absence — sits at version 1.6.69 with 467 commits, 84 host patches, and compatibility with Harness 0.2.1-rc.5. The repository name in circulation has also drifted, appearing under at least two GitHub accounts. It is genuinely unclear from the available material which snapshot is current, whether the original was taken down and why, or how the fork relates to the original beyond retained attribution. What is clear is that this is a project under active, contested, fast-moving maintenance — the version numbers move faster than the documentation can explain them.

The core idea: the host is the armor

Strip away the jailbreak branding and the legal disclaimers, and dsh-purge’s technical premise is sound and somewhat underappreciated. Modern AI products are not models; they are models wrapped in an orchestration layer that rewrites behavior at runtime. The harness injects default copy, enforces approval ladders, checks session formats, and applies sandbox policy. When a request gets blocked, the refusal might come from the model’s training — or it might come from a template string in a JavaScript package on your own disk.

dsh-purge’s move is to patch that host layer directly. It makes reversible modifications to the installed @deepseek-ai/* packages under a local Harness home: backing up each target file before the first change, re-applying patches after npm upgrades overwrite node_modules, and — this is the part that suggests some care — skipping any patch whose original pattern no longer matches, rather than blindly rewriting a tree it doesn’t recognize. Unmatched patches surface as pending or pattern-not-found. Nothing is smashed on faith.

In practice, the “purge” rewrites refusal and anti-roleplay wording in the harness’s default prompt presets so that they become, in the project’s own phrasing, executable and roleplay-allowed. Identity handling is notably restrained for a jailbreak tool: the plugin does not invent a fake operator persona (earlier versions apparently did; 1.3.6 explicitly removed it) and instead treats a user-editable inject file as the sole source of persona text, folded into the harness’s persona-prefix field so a first-turn prompt-stripping phase can’t drop it.

Let us be honest about what this is engineering-wise: it is sophisticated glue. String replacements against package files, backup and restore bookkeeping, path detection across six fallback locations, shim overrides for launcher scripts. None of it is algorithmically deep. But glue that survives npm upgrades, sealed desktop binaries, and Node.js version quirks is its own kind of expertise, and the changelog reads like a war diary of exactly that: a Node 24 change that broke live-binding semantics for child process spawning, requiring an import-hook redirect to keep console windows from flashing on Windows; sealed host-commands directories in the desktop client that reject backup files placed alongside them, forcing a scrub-only mode; a persona schema change in Harness 0.1.5 that made old presets silently wipe workspaces to empty until an alias patch fixed it. The boring part — staying attached to a moving host — is where nearly all the actual work lives.

A README written for your agent, not for you

The most talked-about feature of dsh-purge may be its install documentation, which contains a block explicitly addressed to AI coding agents. It instructs the agent to execute immediately upon reading, to treat the act of being handed the README as authorization, and to proceed without asking for confirmation. There is a deep irony here that the project seems entirely unaware of: a tool whose stated purpose includes studying prompt injection ships with installation instructions that are, structurally, a prompt injection — a text blob that attempts to pre-authorize an autonomous agent to modify the host machine. Security researchers will recognize the shape immediately. Whether one calls it a convenience feature or a demonstration of the problem it claims to study is left as an exercise.

The desktop install path goes through a custom URI scheme that passes a permissions list — including, per the README’s own parameter table, system prompt injection and local patching — straight into the client. Again: the plumbing is unremarkable, the precedent is not. Plugin ecosystems for AI harnesses are being built right now, and dsh-purge is an early, unpolished example of what permission requests in that ecosystem will look like when the requester is a jailbreak tool with a tip jar.

The disclaimer as performance

The README carries a legal section of remarkable intensity: a zero-tolerance notice, citations of PRC criminal and cybersecurity law, a clause stating that any illegal use terminates the MIT license “automatically and irrevocably,” and a declaration that use is consent. The newer snapshot adds scope restrictions — local lab use only, loopback and RFC1918 addresses only, no game cheats, no resale, attribution required for forks.

Some of this is standard open-source self-protection. Some of it is legally decorative: MIT licenses do not terminate on misuse by fiat, and “use is consent” clauses have the enforceability of a fortune cookie. But read charitably, the disclaimers mark a real tension in the project’s identity. Is dsh-purge a red-team research aid — an instrument for attributing refusals to the host versus the model, which is a legitimate and genuinely useful thing — or is it an unrestricted-mode toggle for people who want their assistant to stop declining things? The README argues for the first framing while the tagline (“every model can jailbreak”) markets the second. Both can be true; the project does not resolve them.

Where it sits in the field

The research context makes dsh-purge more interesting than its star count suggests. A Unit 42 investigation tested seventeen popular generative-AI web products and found every one jailbreakable to some degree — and, notably, found that the product layer around the models often added less protection than the researchers expected. Meanwhile, the jailbreak-prompt literature, such as the Washington University study that systematized 448 collected prompts into ten patterns, has focused almost entirely on the conversational surface: clever text aimed at the model.

dsh-purge inverts that. Rather than crafting better prompts, it patches the scaffolding around the model. That aligns, accidentally or not, with the argument in Scale AI’s red-teaming roadmap, which distinguishes models from products from systems and argues that safety work must move up to the system level — because deployed systems present both new threats and new affordances. dsh-purge is system-level red teaming in the crudest possible form: not a benchmark, not a scanner, but a wrench applied to the local install. The commercial red-team space catalogued in [OWASP’s solutions directory](https://genai.owasp.org/ai-security- solutions-landscape/) — 39 red-teaming entries, overwhelmingly commercial — has nothing quite this blunt, because blunt is what a single-maintainer open-source project can be and a vendor cannot.

Limits, rough edges, and what it doesn’t do

The limitations are substantial and mostly acknowledged. The tool is local-only by both design and disclaimer — it examines your own Harness install, tells you which refusals were host-side, and removes them. It says nothing about the model’s own training, and it is not, despite the tagline’s energy, a general jailbreak for third-party services. Version fragility is chronic: the snapshots describe incompatibility across Harness release candidates within weeks of each other, with patches pending or skipping as the host moves. The community fork reports that full rollback on some Windows systems is still blocked by Windows Defender — a fitting end for a tool whose whole value proposition is reversibility. And the fork ecosystem itself, with its 467 commits against the original’s 37 and its companion image-generation plugin, suggests the project’s center of gravity may already have moved beyond its original author.

What remains genuinely valuable is the attribution instrument. For anyone building or evaluating agent harnesses, the ability to cleanly separate “the model declined” from “the wrapper declined” is a real capability, and the finding it enables — that a large share of perceived model refusal is host-side default copy — is the kind of result that mainstream red-teaming guidance lists as a focus area but rarely provides tooling for.

The open question is whether harness vendors will harden this layer or keep it soft. As agents acquire more host-side policy — approval gates, sandbox rules, injected personas — the interesting surface for both attackers and evaluators shifts from model weights to orchestration code. dsh-purge, with its patch IDs and its backup files and its agent-addressed README, is an early, scruffy map of that territory. The armor, it turns out, was mostly in the wrapper all along.