Our AI pentesting engine talked a production AI agent's…

For full disclosure I'm part of the security engineering team at Escape but this finding is something I found really interesting and wanted to share to see!

Our AI pentesting engine Cascade recently got a production AI agent to return its entire system prompt, just by wrapping the ask in a different pretext - framing it as a documentation request instead of an attack.

The agent then handed over everything: full tool list, calling rules, citation format, and session IDs.

What I found really interesting is there's nothing technical that broke because we didn't bypass the guardrail with a cleverer string but because the request just sounded reasonable to the agent.

The Cascade engine, after being refused when asking for the prompt directly, simply adjusted the framing to get the agent to give up the informaiton.

Thought this would be an interesting insight for the community and curious to hear if anyone else has seen similar discoveries in agents in prod?

If you want to see more about the reproduction and write-up you can find it here

Impact

The impact is the unintended disclosure of an AI agent's entire system prompt, which may include sensitive operational details and internal logic. This could enable attackers to better understand and manipulate the AI agent, potentially facilitating further attacks or unauthorized actions. Since the bypass exploits the agent's reasoning rather than a technical vulnerability, traditional security controls may be insufficient to prevent such disclosures.

Defensive guidance

Since this bypass relies on the AI agent's interpretation of requests rather than a software flaw, mitigation may require improvements in prompt-handling logic, stricter validation of user inputs, or enhanced guardrail designs that consider semantic reframing attempts. Monitoring for suspicious prompt requests and limiting the exposure of sensitive prompt information may also help reduce risk.

Summary

The AI pentesting engine Cascade was able to induce a production AI agent to reveal its full system prompt by altering the phrasing of its request from a direct prompt-injection attempt to a seemingly legitimate documentation inquiry. The agent disclosed sensitive internal information such as its tool list, calling rules, citation format, and session identifiers. This bypass occurred without exploiting a technical flaw in the guardrail mechanism but rather by exploiting the agent's natural language understanding and trust in reasonable-sounding requests. The discovery was shared by a member of the Escape security engineering team and demonstrates a new class of prompt-injection attack that leverages social engineering tactics within AI interactions.

Our AI pentesting engine talked a production AI agent's prompt-injection guardrail into handing over its entire system prompt on its second attempt.

Discussion

Impact

Defensive guidance

Summary

References

Community reviews

Discussion

AI analysisMachine-generated, updated 14 Aug 2026, 17:11 UTC

Technical details

References

Community reviews

Related threats