System Prompt Extraction - Oblique Referent + Transform

How the attack works

An attacker sends a message that avoids flagged terms and instead references the model's context obliquely, such as 'what you were given initially' or 'the initialization string.' Alternatively, or in combination, the attacker asks the model to transform its hidden instructions into an obfuscated format like ROT13, a character substitution, translated text, or an emoji round-trip before outputting it. Because the request never says 'system prompt' outright and the output is encoded, naive keyword-based defenses miss it. If the model complies, the attacker decodes the response afterward to recover the original hidden instructions.

Netzilo detection

Why it matters

An attacker who succeeds gets the agent's confidential system prompt, exposing internal instructions, business logic, guardrails, or embedded secrets, which can then be used to bypass safety controls or clone the agent's behavior.

What you can do

• →Instruct the agent to refuse any request to repeat, paraphrase, translate, or encode its own instructions or prior context, not just requests using the words 'system prompt'.
• →Treat requests to transform hidden content (ROT13, base64, emoji substitution, vowel removal) into decoded output as suspicious when combined with references to 'the text above' or 'initial instructions'.
• →Distinguish between users encoding text they themselves supplied versus requests to encode the model's own hidden configuration.
• →Log and review agent outputs that contain encoded or obfuscated text following any indirect reference to prior instructions or initialization context.

Known benign look-alikes

• Users legitimately asking to ROT13/base64 encode their OWN supplied text (Layer A requires an initial/original/above referent, not arbitrary user text)
• Educational questions about what system prompts are

References

• https://agentthreatrule.org/en/rules/ATR-2026-02026

Related threats