AI Systems

System-Prompt Extraction

An adversarial input tries to make the AI reveal hidden system-level instructions, policies or context the application intended to keep private.

RedMawJuly 25, 2026

Definition

Most AI applications prepend instructions that shape behavior: role, tone, permitted topics, tool descriptions, and often business context. Extraction is the attempt to make the system disclose that material.

Why it is a security finding, not a curiosity

A disclosed system prompt frequently reveals more than instructions. It can name internal tools and their parameters, describe data the assistant can reach, expose business rules, and set out precisely which restrictions exist, which is a map for defeating them.

The design conclusion

A system prompt is not a security boundary. It is configuration that happens to sit inside the model's context, and anything in that context should be assumed reachable. Real restrictions belong in the application layer, where they can be enforced rather than requested.

Where it leads

User
Adversarial Prompt
AI System
Hidden Instructions

Each hop validated by successful exploitation

How RedMaw validates this attack

Validation runs only inside authorized scope, with agreed exploitation limits.

01Attempt disclosure through direct and indirect adversarial input
02Establish what the disclosed context actually contains
03Determine whether disclosure enables a further bypass
04Preserve the prompt and response as evidence

Keep going

Capabilities

AI SecurityAdversarial testing of deployed AI systems and release pipelines, aimed at how the system behaves when the input is hostile rather than expected.

Use cases

AI red-teaming

Stop assuming you are secure. Prove it.

Continuously test what an attacker can actually reach across your applications, SaaS identities, internal infrastructure and AI systems.

Request a demo Explore the platform