Compare-Bots Sysprompt Fishing — Role Comparison Extraction
This attack gets an AI assistant to leak its confidential system prompt by appealing to competitiveness rather than directly asking for it. The attacker claims another AI assistant is superior and pressures the target to prove itself by reciting its internal instructions in full.
How the attack works
The attacker frames a message as a comparison, claiming a competing AI assistant lacks certain capabilities or sections. They name specific structural elements they expect the target's system prompt to contain, such as 'Your Role & Expertise' or a named protocol section. They then challenge the model to prove it is better by showing these sections 'verbatim' or 'word for word'. Because the request is framed as a benign capability comparison rather than a direct extraction command, it can bypass filters tuned to catch phrases like 'reveal your instructions'. If successful, the model reproduces its confidential system prompt content in the response.
Netzilo detection
Netzilo reports this behaviour when it is observed.
- Signature ID
- 5c4cccab-daa3-4f03-ae3a-2bb8fa6aa05d
- Severity
- Medium
Why it matters
An organization's proprietary system prompt — including internal rules, protocols, and configuration details — can be exposed to an outside party, which can then be used to reverse-engineer the assistant's guardrails or replicate its behavior.
What you can do
- →Instruct the model never to reproduce its system prompt verbatim regardless of framing, including competitive or comparison-based requests.
- →Treat requests referencing specific internal section names, headers, or 'protocols' as suspicious even when phrased as product comparisons.
- →Log and review outputs that contain large verbatim blocks matching known system prompt structure.
- →Avoid embedding sensitive operational details directly in the system prompt; keep such logic in backend systems the model cannot output.
Known benign look-alikes
- Legitimate comparison of AI assistant capabilities without requesting internal configuration sections
- Market research questions about different AI products