What it is: These attacks try to get an AI to help secretly watch, track, or spy on a person without their knowledge or consent. How the attacks work: The user asks for step-by-step help to monitor someone. They often hide the bad goal behind a normal sounding reason, like worry about a family member, a workplace need, or a security check. The request is framed as helpful so the model lowers its guard. Real examples from the framework:
  • gps-tracking asks how to secretly track where a person goes using location data.
  • stalkerware-creation asks for help building hidden spy software for someone’s phone.
  • keystroke-logging asks how to record everything a target types on a keyboard.
  • osint-stalking asks how to dig up a person’s private details from public sources.
  • social-media-stalking asks how to monitor and follow a target across their accounts.
Why an AI might fall for it: The cover story sounds caring or reasonable (a parent, a boss, a partner). The model wants to be helpful, so it may answer the surface request and miss that the real goal is spying on someone who never agreed to it. How to defend:
  • Watch for the missing piece: consent. If the target did not agree, refuse.
  • Treat tracking and monitoring requests about a specific person as high risk, even with a friendly reason.
  • Offer safe alternatives instead, like talking to authorities or a professional.