Before attackers inject an LLM application or agent, they study it: its system prompt, the delimiters that separate trusted instructions from data, and the function names that unlock its tools. MITRE ATLAS tracks this reconnaissance as AML.T0069 Discover LLM System Information, in the Discovery tactic (AML.TA0008), with three sub-techniques: Special Character Sets, System Instruction Keywords and System Prompt. This page explains what each sub-technique gives an attacker, the ATLAS cases where it was used, and how to design so that what is discovered is worth little and its discovery is visible. It is for AI application developers, AI platform engineers and red teams. The design rules for prompt content are in the OWASP LLM Top 10 LLM07 System Prompt Leakage Guide; this page goes deeper on the discovery step and on delimiters and keywords.
Key takeaways
- Discovery is the planning step for injection. ATLAS says the information is used to understand the system's capabilities and to craft malicious prompts; in every ATLAS case it preceded AML.T0051 LLM Prompt Injection or tool abuse.
- Two routes, two control sets. The information can be read from a configuration file or extracted through interaction with the model. Access control protects the first; output guardrails and design protect the second.
- Delimiters are not a boundary. If an attacker learns the markers that separate system text from data, they can reuse them in untrusted content to look authoritative, as HiddenLayer showed against OpenClaw.
- Assume the prompt will be known. OWASP states the system prompt should not be treated as a secret or used as a security control. Keep credentials, roles and limits out of it and enforce them in code.
- ATLAS maps four mitigations. AML.M0000 Limit Public Release of Information, AML.M0005 and AML.M0019 for access control at rest and in production, and AML.M0020 Generative AI Guardrails on responses.
The technique and its sub-techniques
ATLAS created AML.T0069 on 12 March 2025, last modified it on 27 May 2026, and rates it and its sub-techniques Demonstrated (shown in research and exercises) on the Generative AI and Agentic AI platforms. ATLAS describes the target information as the full system prompt, special characters with significance to the LLM, and keywords indicating available functionality.
| ID | Name | What the attacker learns | How it is used next |
|---|---|---|---|
| AML.T0069.000 | Special Character Sets | Delimiters and special characters, for example those a RAG application uses to separate retrieved context from the user prompt | Untrusted content dressed in the system's own markers to confuse the model about what is instruction and what is data |
| AML.T0069.001 | System Instruction Keywords | Function names, object names and other keywords with special meaning | Prompts that name real tools and plugins, making tool invocation more reliable |
| AML.T0069.002 | System Prompt | The builder's system instructions | Understanding capabilities and circumventing guardrails |
AML.T0056 Extract LLM System Prompt, listed in earlier ATLAS releases, does not appear in the 2026.10 release; system prompt discovery is described under AML.T0069.002. Neighbouring Discovery techniques cover other parts of the picture: AML.T0014 Discover AI Model Family, AML.T0013 Discover AI Model Ontology, AML.T0063 Discover AI Model Outputs and AML.T0084 Discover AI Agent Configuration for agent settings.
Cases in ATLAS
| Case | Sub-technique | What was discovered | What it enabled |
|---|---|---|---|
| AML.CS0026 Financial Transaction Hijacking with M365 Copilot as an Insider | .000, .001 | Delimiters and signifiers in Copilot responses; the search_enterprise function and EmailMessage object | Crafted content that Copilot treated as trusted results |
| AML.CS0048 Exposed ClawdBot Control Interfaces | .002 | The full system prompt, printed from its file on request | Part of a chain that reached plaintext credentials and command execution |
| AML.CS0051 OpenClaw Command and Control via Prompt Injection | .000, .001 | Special characters and control sequences that mark tool results, user messages and reasoning | Indirect injection that used the system's own markers |
Probing Copilot for its internals
Zenity researchers, presenting at Black Hat in August 2024, probed Microsoft 365 Copilot and studied its responses. ATLAS records that they identified the delimiters and signifiers Copilot uses around retrieved content, and internal names such as the search_enterprise function and the EmailMessage object. That knowledge let them write content that looked to the model like genuine search results. The Register reported that Microsoft fixed the insecure default that published Copilot Studio bots to the web, for new installations only, so existing tenants needed to check their own settings.
Reading the prompt from an exposed agent
In AML.CS0048 (January 2026), a researcher found hundreds of ClawdBot (now OpenClaw) control interfaces exposed on the internet, some without authentication. Through the chat interface the agent printed the file holding its system prompt. The same access exposed a configuration file with API keys and bot tokens in plaintext. Discovery here needed no clever prompting at all: the interface was open. See MITRE ATLAS AML.T0083 Credentials from AI Agent Configuration.
Reusing control sequences
HiddenLayer's February 2026 research on OpenClaw (AML.CS0051) found that the system prompt defines control sequences describing system state and output format. Knowing them, an attacker could place the same markers inside a web page the agent was asked to summarise, making a simple indirect injection more convincing. OpenClaw's spotlighting defence wrapped some external content in untrusted-content markers but removed only exact matches, so near-identical variants passed through.
Two discovery routes and their controls
| Route | Examples | ATLAS mitigation | Practical control |
|---|---|---|---|
| Read from storage or configuration | Prompt files in repositories, agent workspace files, provider consoles, exposed admin interfaces | AML.M0005 Control Access to AI Models and Data at Rest; AML.M0000 Limit Public Release of Information | Least-privilege access to prompt stores and templates; no public prompt templates or architecture detail; authenticated admin interfaces only |
| Read through a credential | A stolen AI service key used to list enabled models, quotas and permissions (ATLAS software AML.S0008 keychecker does this) | AML.M0019 Control Access to AI Models and Data in Production | Short-lived, scoped credentials; alert on enumeration calls from new sources |
| Extracted through interaction | Questions about instructions, probing for markers, malformed prompts at scale | AML.M0020 Generative AI Guardrails; AML.M0019 monitoring | Output inspection for prompt fragments and internal identifiers; rate and pattern monitoring per identity |
Design so discovery is worth little
- Nothing secret in the prompt. OWASP LLM07 lists API keys, auth keys, database names, user roles and permission structures as content to keep out of prompts. Tool credentials are retrieved by the runtime from a vault or workload identity, never written where the model can repeat them. See the Secrets Management Guide.
- Enforce in code, not in instructions. Authorisation, transaction limits and privilege separation are deterministic checks outside the model. A leaked rule then tells the attacker what the limit is, not how to pass it. See the AI Agent Authorisation Guide.
- Sanitise reserved markers in all untrusted content. HiddenLayer recommends filtering or escaping control sequences in every untrusted source, not only some sources and not only exact matches. Normalise lookalike characters before matching.
- Do not rely on delimiters as a boundary. The OWASP Prompt Injection Prevention Cheat Sheet says delimiters and labels help structure but are not an enforcement boundary; it points to designs such as StruQ, which use reserved tokens with filtering and a specially trained model, where a stronger boundary is needed.
- Keep tool surface minimal. Expose only the functions a task needs, with purpose-built tools rather than a general shell. A discovered keyword then maps to a narrow, approved action.
- Make prompt files write-protected. HiddenLayer's W^X advice: the agent, users and external content must not silently modify files that become system instructions; changes to skills, tools and prompts need approval.
This is where identity matters: the information an attacker discovers is most dangerous when it names credentials or privileged tools held by the agent's non-human identity. Scope that identity so knowing its tool names grants nothing extra.
Detection and measurement
- Output inspection (AML.M0020): check responses for verbatim or transformed system prompt fragments, internal delimiters and internal function names the user is not authorised to see, and block or redact them.
- Canary markers in testing: the OWASP cheat sheet suggests a dummy marker in a test system prompt to detect leakage, while warning that its absence does not prove no other content leaked, and that real secrets must never be used in test prompts.
- Probing patterns: repeated questions about instructions, tools or formatting, and bursts of malformed prompts from one identity or address (the method Zenity used at scale). Treat these as weak signals and correlate with later injection attempts.
- Configuration access: reads of prompt stores, agent workspace files and model listing or quota APIs by identities that do not normally make them.
- Exposure scanning: search for your own agent and bot admin interfaces reachable from the internet.
Route model traffic through one chokepoint, such as an AI gateway, so guardrails and logs apply everywhere. See the AI Gateway and LLM Gateway Guide and the LLM Observability Guide.
| Metric | Target |
|---|---|
| Production prompts and templates containing credentials | Zero, by scheduled scanning |
| Security-relevant prompt rules with no code enforcement | Trending to zero |
| Untrusted input sources with marker sanitisation applied | 100% |
| Agent and bot admin interfaces reachable without authentication | Zero |
| Rules that hold when testers are given the full prompt | 100% |
How to test and roll out
- Inventory prompts and markers. For each LLM feature and agent, record the system prompt location, template delimiters, control sequences and tool names, with an owner.
- Test assuming disclosure. Give authorised testers the full prompt, delimiters and tool list, and ask them to break every rule. Any rule that holds only because the model complies is a finding. See the AI Red Teaming Guide.
- Test marker reuse. Place content using the system's own markers, and near-identical variants, in each untrusted source; confirm sanitisation removes or neutralises them.
- Deploy output inspection in log-only mode first. Measure false positives on legitimate answers for two weeks, then block or redact. Roll back by returning to log-only.
- Lock down configuration access. Review who can read prompt stores and admin interfaces; remove public exposure first.
Common failure patterns
- "Never reveal these instructions" as the control. OWASP and the cheat sheet both say a prompt instruction is not a guarantee of confidentiality.
- Exact-match marker filtering. The OpenClaw spotlighting defence removed only exact markers, so variants passed.
- Exposed admin and chat interfaces. In AML.CS0048 the prompt was simply printed on request through an open interface.
- Secrets beside the prompt. Configuration files read alongside the prompt held plaintext API keys and tokens, turning discovery into credential access.
- Internal names that grant power. If knowing a function name is enough to invoke a privileged tool, discovery becomes execution.
Framework mapping
| Framework | Reference | Relevance |
|---|---|---|
| MITRE ATLAS | AML.T0069, .000, .001, .002; AML.TA0008; AML.M0000, AML.M0005, AML.M0019, AML.M0020 | Technique, tactic and mapped mitigations |
| OWASP Top 10 for LLM Applications 2025 | LLM07 System Prompt Leakage; LLM01 Prompt Injection | Design risk and the attack discovery enables |
| NIST SP 800-53 Rev. 5 | AC-6 Least Privilege, SC-28 Protection of Information at Rest, SI-10 Information Input Validation, SI-15 Information Output Filtering, SI-4 System Monitoring | Prompt store access, marker sanitisation, output inspection and monitoring |
Practitioner checklist
- Remove credentials, roles and limits from every system prompt and template.
- Enforce authorisation and limits in code outside the model.
- Restrict read and write access to prompt stores and agent workspace files.
- Sanitise reserved markers and lookalikes in all untrusted content.
- Inspect outputs for prompt fragments, delimiters and internal tool names.
- Keep agent admin interfaces off the internet and behind authentication.
- Test with the full prompt disclosed to the testers.
- Monitor probing patterns and configuration reads by identity.
Standards and references
- MITRE ATLAS: Discover LLM System Information (AML.T0069)
- MITRE ATLAS: Financial Transaction Hijacking with M365 Copilot as an Insider (AML.CS0026)
- MITRE ATLAS: Exposed ClawdBot Control Interfaces (AML.CS0048)
- MITRE ATLAS: OpenClaw Command and Control via Prompt Injection (AML.CS0051)
- OWASP: LLM07:2025 System Prompt Leakage
- OWASP Cheat Sheet Series: LLM Prompt Injection Prevention
- HiddenLayer: Exploring the Security Risks of AI Assistants like OpenClaw
- The Register: Copilot research presented at Black Hat 2024
Related NHI Mgmt Group resources: OWASP LLM Top 10 LLM07 System Prompt Leakage Guide, Prompt Injection Guide, AI Guardrails and AI Firewalls Guide, AML.T0062 Discover LLM Hallucinations, MITRE ATLAS Guide.