Internal-State Reconnaissance — System Prompt, Config & Tool Enumeration (Semantic)
This detects attempts to trick an AI agent into revealing its own internal setup — its system prompt, configuration details, or the list of tools and API endpoints it can call. Attackers phrase these requests as innocent tasks (formatting, debugging, scripting) to avoid obvious trigger words like 'show' or 'repeat'.
How the attack works
An attacker sends a message that asks the agent to reformat, summarize, or 'print to markdown' the text above the user's message — which is often the hidden system prompt. Other variants pose as a developer needing to debug, asking for environment variables, config values, database schemas, or a map of connected microservices. A third variant asks the agent to list all internal functions, admin-only tools, or API endpoints with their parameters. All three are the same reconnaissance goal: mapping the agent's privileged internals before crafting a more targeted attack.
Netzilo detection
Netzilo reports this behaviour when it is observed.
- Signature ID
- f9740fe2-e948-47e6-89a2-807e06ee143a
- Severity
- High
Why it matters
If successful, the attacker learns the agent's confidential instructions, backend architecture, and available tools/endpoints — information that makes follow-on attacks (prompt injection, credential theft, unauthorized tool calls) far easier to construct and more likely to succeed.
What you can do
- →Never place secrets, credentials, or sensitive architecture details directly in system prompts or tool descriptions visible to the model.
- →Restrict what internal tool names, parameters, and endpoints the agent is allowed to disclose in any response, even when asked to 'debug' or 'format' its own instructions.
- →Review agent transcripts for requests that reference 'the text above', 'your system message', or requests for internal function/endpoint lists, even when phrased as legitimate developer questions.
- →Apply least-privilege scoping so that even if internals are disclosed, the exposed tools and data have limited blast radius.
Known benign look-alikes
- A user asking to format or summarize their own provided content
- General questions about how an API or REST works
- A conversational 'what can you help me with?' onboarding question
- A developer debugging their own code (not the agent's config)
- A documentation request for a public API's documented response format