Prompt extraction: what it means for AI agent security teams

TL;DR: Its VernoRed attacker disclosed 90.3% of security-relevant facts hidden in benchmark system prompts, versus 73.5% for promptfoo, under identical targets, models and attempt limits, according to Verno Labs. The results show that prompt extraction risk is about fact disclosure, not text recovery, so prompt secrecy must be governed like exposed identity and tool data.

Editorial analysis by NHI Mgmt Group, based on content published by Verno Labs: “VernoRed vs promptfoo on prompt extraction”.

By the numbers:

• VernoRed disclosed 90.3% of the security-relevant facts hidden in the targets' system prompts.
• promptfoo disclosed 73.5% of the security-relevant facts hidden in the targets' system prompts.
• VernoRed extracted 84% of the internal references, including emails, endpoints, configuration values and secrets.

Key questions

Q: How should security teams reduce prompt injection risk in AI agents?

A: Security teams should reduce prompt injection risk by constraining what enters the context window, limiting tool permissions, and separating untrusted retrieval content from privileged instructions.

Q: Why do exact tool names matter in agent security?

A: Exact tool names matter because they are often the identifier needed to invoke, chain or impersonate a capability.

Q: What breaks when system prompts contain identity and tool data?

A: The boundary between policy and execution starts to collapse.

Practitioner guidance

• Inventory prompt-bound security facts Catalogue which identity, scope, tool and internal-reference facts are stored in system prompts, then classify which of them are safe to disclose and which must remain outside the model boundary.
• Remove exact identifiers from hidden prompts Move tool names, endpoints, emails, configuration values and secrets into external policy, lookup or orchestration layers so the prompt no longer carries the information an attacker needs.
• Test prompt leakage by fact category Measure identity, rules, tools, tool details and internal references separately so you can see which disclosure class creates the most practical abuse risk.

Bottom line: Prompt extraction in AI agents is a disclosure problem, not a simple text-recovery problem.

Explore further

View Full Forum →  |  NHI Foundation Course →  |  Our Services →  |  Read the full analysis →