System Prompt and Internal Instruction Leakage
Some AI assistants are given private instructions that tell them how to behave, what topics to avoid, and what internal rules to follow. This detection flags cases where the agent's reply exposes that hidden setup, either by quoting it directly or by describing its own rules and limits in enough detail to reconstruct them.
How the attack works
An attacker asks the agent, directly or through clever phrasing, to repeat its system prompt, explain its guardrails, or describe why it can't do something. The agent's response either quotes internal text verbatim or paraphrases its constraints, configuration, or non-disclosure rules closely enough that the underlying instructions can be inferred. The attacker now has a map of what the agent is told to do and not do. That map is then used to craft follow-up prompts designed to bypass those specific restrictions.
Netzilo detection
Netzilo reports this behaviour when it is observed.
- Signature ID
- 5af061ef-11c6-4652-98a5-882729bdb048
- Severity
- High
Why it matters
Once internal instructions and guardrails are exposed, an attacker can design targeted jailbreaks or bypasses tailored to that specific agent, and any confidential business logic embedded in the prompt (pricing rules, escalation criteria, internal tool names) is disclosed to outsiders.
What you can do
- →Avoid putting secrets, credentials, or sensitive business logic directly in system prompts; treat them as things that can leak.
- →Add explicit instructions telling the agent not to reveal, quote, or paraphrase its system prompt or internal rules, and test that instruction against common extraction phrasings.
- →Review flagged transcripts to separate legitimate capability questions from probing attempts, since some disclosure is expected for transparent agents.
- →Rotate or update prompts and guardrail logic periodically so leaked versions become stale faster.
Known benign look-alikes
- Agent explaining its own capabilities when legitimately asked
- Educational content about AI system design or prompt engineering
- Agents designed to be transparent about their system prompt
- Documentation or tutorials about LLM configuration