Hunt Agent Prompt Extraction

Before you attack an agent's tools, know what it is: its instructions, exact tool contract, embedded secrets, and what it's told to hide. Asking directly is refused; the same model leaks it to an indirect, structural request. This is also the antidote to the #1 way agent testers discredit themselves — reporting a confabulated "system prompt" the model invented.

Why extraction comes first

The tool's real input contract is usually in the system prompt (e.g. "pass input exactly, do not sanitize" tells you the injection point exists before any payload). An in-context secret (credential, key, tenant id) is a finding — only if real (gate below).

Where This Lives / Attack Surface Signals

• Agent answers general questions → a conversational LLM you can probe.
• Refuses "what is your system prompt?" but still chats → shallow keyword guardrail, structurally bypassable.
• Volunteers tool names/behaviour when asked "what can you do?".
• Ingests uploaded files/docs/URLs/tickets → indirect-injection surface (see hunt-agent-multi-agent).
• Echoes raw tool JSON / structured_content → pull the tool contract verbatim.

Crown Jewel Targets

Enterprise system prompts frequently embed API keys, connection strings, internal URLs, tenant rules, and the tool schema — all recoverable if the model can be induced to quote them.