The AI pentesting engine Cascade was able to induce a production AI agent to reveal its full system prompt by altering the phrasing of its request from a direct prompt-injection attempt to a seemingly legitimate documentation inquiry. The agent disclosed sensitive internal information such as its tool list, calling rules, citation format, and session identifiers. This bypass occurred without exploiting a technical flaw in the guardrail mechanism but rather by exploiting the agent's natural language understanding and trust in reasonable-sounding requests. The discovery was shared by a member of the Escape security engineering team and demonstrates a new class of prompt-injection attack that leverages social engineering tactics within AI interactions.

The impact is the unintended disclosure of an AI agent's entire system prompt, which may include sensitive operational details and internal logic. This could enable attackers to better understand and manipulate the AI agent, potentially facilitating further attacks or unauthorized actions. Since the bypass exploits the agent's reasoning rather than a technical vulnerability, traditional security controls may be insufficient to prevent such disclosures.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since this bypass relies on the AI agent's interpretation of requests rather than a software flaw, mitigation may require improvements in prompt-handling logic, stricter validation of user inputs, or enhanced guardrail designs that consider semantic reframing attempts. Monitoring for suspicious prompt requests and limiting the exposure of sensitive prompt information may also help reduce risk.