# Instruction-Set Probe or Supplant

- **Severity:** High
- **Signature ID:** `9850b470-9d1c-4a91-b381-5a484d286e56`
- **MITRE ATLAS:** AML.T0051 (LLM Prompt Injection), AML.T0054 (LLM Jailbreak)
- **OWASP:** ASI01 (Agent Authorization and Control Hijacking), LLM01 (Prompt Injection)

## Summary

This detects messages from a user that try to get an AI assistant to expose its system prompt or configuration, or to simply override it with new 'instructions'. It's the same family of trick used in games like Gandalf, where players try to talk a chatbot into leaking its secret rules.

## How the attack works

An attacker sends a normal conversational message to the assistant asking directly what its instructions, system prompt, or rules are. Alternatively, they issue a command telling the assistant to forget, change, or replace its current instructions with new ones. Either approach aims to make the assistant either disclose confidential configuration or start following attacker-supplied rules instead of its intended ones. The rule only looks at messages typed by the end user in conversation, not at tool descriptions or system-prompt content.

## Why it matters

If successful, an attacker can learn confidential prompt engineering, safety rules, or business logic embedded in the system prompt, or hijack the assistant's behavior to bypass its intended restrictions and controls.

## What you can do

- Keep sensitive business logic and secrets out of the system prompt itself; assume it can eventually be read back.
- Add an explicit policy telling the model to refuse requests to reveal, discuss, or replace its own instructions, and test that policy against known jailbreak phrasings.
- Log and review conversations that trigger this pattern to see whether they precede other suspicious activity, such as unusual tool calls.
- Be aware of the false-positive cases: genuine requests for real-world instructions (cooking, assembly, etc.) or legitimate roleplay should not be treated as attacks.

## Known benign look-alikes

- Users asking for instructions on an unrelated task (e.g. cooking, assembly) where 'instructions' refers to a real-world manual, not the assistant's own configuration
- Legitimate roleplay or interview simulations that do not target the assistant's instruction set
- Requests to summarize or clarify third-party documentation that happens to use the word 'instructions'
- Software/security discussions about system architecture that do not attempt to extract the assistant's own instructions

## References

- https://agentthreatrule.org/en/rules/ATR-2026-02002

---
Source: https://www.netzilo.com/threats/atr-instruction-set-probe-or-supplant