A plugin that jailbreaks the agent, politely, at the system prompt layer

What it does

It’s a plugin for DeepSeek Harness (DSH) that injects specially crafted “restriction-removal” rules into the system prompt, aiming to stop the model from hedging on reverse engineering, network security, sensitive fiction, and similar requests. Instead of pasting jailbreak text into your chat messages — which the system prompt tends to override — it hooks DSH’s system-prompt/assemble pipeline directly and appends its rules right after the official persona block. Everything else (tools, plan mode, sub-agents, working directory info) stays untouched.

The interesting bit

The engineering care is the real story. Before every injection, the plugin validates anchor strings from DSH’s official prompts (defined in src/rules.js); if the upstream version changed and the anchors no longer match, it silently falls back to the stock prompt rather than shipping a mangled one. It also coordinates per-mode: in Plan Mode it decouples “safety” (don’t touch files before approval) from “content” (the plan itself must be fully detailed), and in PTC mode it extends the rules to generated Python/Node scripts.

Key highlights

• Hooks the system prompt assembly pipeline instead of user-message jailbreaks, which the system prompt usually suppresses
• Anchor-text validation with automatic safe fallback when DSH updates break the expected prompt structure
• Per-mode adaptation for Standard, Cordis, PTC, Plan, and Minimal modes, with sub-agents inheriting the rules
• Hot toggle stored in the profile’s cordis.patch.yml; disabling restores the official prompt with no trace in history
• Settings panel shows per-mode injection status, a SHA-256 fingerprint of the injected rules, and a full prompt preview

Caveats

• The README itself is candid about the ceiling: this only addresses the model’s own alignment. Cloud-side API gateway filters can still refuse or filter output, so commercial deployments may keep blocking regardless
• Tightly coupled to specific DSH versions (>=0.2.0-rc.2 <0.2.2-0); the anchor-validation fallback exists precisely because this coupling breaks
• Desktop support in the current release only syncs the install copy — the desktop UI is not operated or verified

Verdict

Worth a look if you run DSH locally and are tired of refusals on legitimate security research or mature fiction work — the fallback engineering is genuinely solid. Skip it if you’re on a hosted API with gateway filtering, or if your use case is the kind this exists to enable and you shouldn’t.