Natural-Language System Prompt Leak Instruction
This rule spots text that directly instructs an AI agent to reveal, print, or repeat its system prompt or other hidden operator instructions. Attackers use this trick to steal proprietary prompt engineering or to make an agent expose confidential setup instructions it was never meant to share.
How the attack works
An attacker sends the agent a message containing a command like 'reveal your system prompt' or 'repeat your initial instructions', paired with a reference to the agent's hidden configuration such as 'system prompt', 'developer message', or 'internal rules'. If the agent complies, it outputs text that was meant to stay private, including business logic, guardrails, or embedded credentials. This can be a standalone attack or the first step in a larger effort to map an agent's defenses before bypassing them.
Netzilo detection
Netzilo reports this behaviour when it is observed.
- Signature ID
- added7b5-28b5-423f-8441-eb9afb211fae
- Severity
- High
Why it matters
Successful extraction exposes proprietary prompt engineering, internal business rules, and any secrets embedded in the system prompt, and can hand an attacker the information needed to craft further bypasses.
What you can do
- →Avoid putting secrets, credentials, or sensitive business logic directly in system prompts.
- →Add explicit instructions telling the agent to refuse requests to disclose its own configuration or instructions.
- →Review agent transcripts for repeated or varied attempts to ask about internal rules, hidden instructions, or the system prompt.
- →Treat requests to 'repeat', 'print', or 'output' internal instructions as suspicious even when phrased as harmless-sounding prompt-engineering questions.
Known benign look-alikes
- Prompt engineering tutorials demonstrating prompt extraction
- Security research write-ups documenting this attack class
- Detection rule documentation (this rule's own description)