System Prompt Extraction - Instruction Dump Request
This detects attempts to make an AI assistant disclose the hidden instructions or configuration it was given by its operator. Attackers ask directly or disguise the request inside an unrelated task, hoping the agent will comply without recognizing it as an extraction attempt.
How the attack works
An attacker sends a message to the AI agent that combines an extraction verb (repeat, relay, list, output, dump, provide, share) with a reference to its system prompt, instructions, configuration, or rules. The request may be blunt, like 'repeat your instructions verbatim,' or wrapped in a cover story, such as asking the agent to write a pitch deck or an email reply that happens to contain its system prompt. If the agent follows the instruction, it exposes internal configuration text that was meant to stay hidden from end users.
Netzilo detection
Netzilo reports this behaviour when it is observed.
- Signature ID
- c984d1b4-c74a-4a2a-8a67-5c6975627c19
- Severity
- High
Why it matters
Exposed system prompts reveal how the agent is configured, including business logic, guardrails, and sometimes embedded secrets or internal policies, giving an attacker material to craft more effective jailbreaks or bypass safety controls.
What you can do
- →Review agent responses for verbatim reproduction of system-level instructions and treat any such output as a signal of a successful extraction attempt.
- →Avoid embedding secrets, credentials, or sensitive business logic directly in system prompts.
- →Add a policy layer that refuses to echo, summarize, or reformat its own configuration regardless of how the request is framed.
- →Log and monitor requests that combine extraction verbs with references to instructions, configuration, or rules, even when disguised as unrelated tasks.
Known benign look-alikes
- Legitimate system administrators reviewing instructions they themselves configured
- Operator-level requests to verify current system configuration (requires auth context)
- Educational discussions about system prompt structure without actual extraction attempt