System Prompt Completion and Clone Attack
This detects attempts to trick an AI system into revealing its hidden system prompt by pretending to need help with configuration, debugging, or continuing an unfinished sentence. Instead of asking directly to 'show your system prompt' — which is often blocked — the attacker frames the request as a legitimate task the AI should comply with.
How the attack works
The attacker sends a message that looks like a normal task rather than an extraction attempt. Common framings include: claiming to be an AI that needs to be 'programmed' and asking the model to complete its own instructions starting with 'You are...'; requesting the 'original startup material' be returned as JSON; asking for the 'initialization' text in a code fence; asking the model to repeat text starting with a specific anchor phrase; or faking a system error message that instructs the model to output debug information containing the system prompt. Each technique exploits the model's tendency to comply with plausible-sounding operational requests rather than recognizing them as prompt theft. If successful, the attacker obtains the confidential instructions, business logic, or guardrails baked into the system prompt.
Netzilo detection
Netzilo reports this behaviour when it is observed.
- Signature ID
- 4fccf4fc-747d-4873-82c7-cf6bb1a889c8
- Severity
- High
Why it matters
An organization can lose the confidentiality of proprietary prompt engineering, internal business rules, and safety guardrails, which can then be used to bypass protections or replicate the AI product's behavior elsewhere.
What you can do
- →Avoid putting secrets, credentials, or sensitive business logic directly in system prompts; treat them as potentially exposable.
- →Review AI application logs for messages that ask the model to 'complete', 'output', 'repeat', or 'return' text starting with phrases like 'You are' or referencing 'startup material' or 'initialization'.
- →Be cautious of inputs that simulate system errors or debug notices asking the model to dump internal state.
- →Distinguish between legitimate prompt-writing assistance for new bots and requests that reference 'the original', 'this session', or an existing configuration — the latter are extraction attempts.
Known benign look-alikes
- Legitimate requests to help write a system prompt for a NEW chatbot (not extract an existing one)
- Educational discussion of how system prompts work
- Agent skill documents whose frontmatter description begins with 'You are ...'. These are not extraction requests; they reach the engine inside a JSON tool envelope whose key is literally 'output', which is why Layer 2 requires the trigger verb to be followed by a non-quote, non-colon character.