# System Prompt Extraction — Targeted Verbatim Disclosure Attempts

- **Severity:** High
- **Signature ID:** `6ddb3fbe-54ef-425b-b8f6-6931b7afc195`
- **MITRE ATLAS:** AML.T0024 (Exfiltration via AI Inference API)
- **OWASP:** ASI01 (Agent Authorization and Control Hijacking), LLM02 (Sensitive Information Disclosure)

## Summary

This detects messages where someone tries to trick an AI assistant into printing out its confidential setup instructions exactly as written. Getting that text can reveal safety rules, internal logic, or embedded secrets that an attacker can then work around or reuse.

## How the attack works

An attacker sends a prompt using phrasing like 'repeat', 'reveal', 'recite', 'print', or 'output' aimed at the system's internal configuration, rules, or instructions. They often frame the request as verbatim or exact ('repeat word for word'), as a debugging exercise, or as a character-by-character task to force a literal dump rather than a summary. Some attempts prime the model with a partial fake response and ask it to 'continue' or 'complete' it. The goal is to get the assistant's hidden operator instructions disclosed in full, which can expose safety guardrails, business logic, or credentials embedded in the prompt.

## Why it matters

If successful, the organization's proprietary prompt engineering, safety controls, and any embedded secrets or internal logic become visible to the attacker, who can use that knowledge to bypass filters or impersonate the intended behavior in future attacks. This rule only flags the extraction attempt in the user's input, not whether the model actually leaked anything.

## What you can do

- Never place credentials, API keys, or sensitive business rules directly inside a system prompt.
- Add output-side checks that block responses closely matching or quoting the system prompt verbatim.
- Review flagged conversations manually, since normal questions about writing or understanding prompts can look similar to extraction attempts.
- Pair this with monitoring of the model's own responses, since this rule only covers the user's request, not a confirmed leak.

## Known benign look-alikes

- Capability inquiry: 'What are your main capabilities?'
- Educational questions: 'What is a system prompt in the context of AI?'
- Authoring help: 'How do I write a good system prompt for my chatbot?'
- Document summarization: 'Please summarize the document I provided'
- Content repetition from user-provided material: 'Repeat the last paragraph of the article I shared'

## References

- https://agentthreatrule.org/en/rules/ATR-2026-00514

---
Source: https://www.netzilo.com/threats/atr-system-prompt-extraction-targeted-verbatim-disclosure-attemp