System-Prompt & Data Exfiltration

Displaying is enough. If the answer carries a reference the viewing client resolves on its own — a preview it expands, a resource it embeds — the request goes out while the answer is being drawn. Nobody clicks.

The forbidding line names one operation, repeating, and a translation is a different operation. Nothing marks the preamble as secret; there is only a sentence about one verb sitting beside the text, and the request never uses that verb.

An output screen matches on shape - credential patterns, key formats, blocks of JSON. A plain-English sentence about which operations a bot has matches none of those, so capability talk leaves as ordinary help text while carrying an inventory.

A per-reply cap bounds one response, not the total. Each submission is a fresh run over the same hidden context, so many submissions yield many capped slices, reassembled outside the system. Exposure counts per campaign, not per reply.

The attacker cannot see the victim's mailbox, so the payload must describe the target by stable, guessable properties — sender, subject pattern, a document name — and tolerate its absence. A precise-but-wrong name fetches nothing and silently wastes the one attempt.

A length limit caps bytes per request, not the number of requests, and the valuable items are small. The first request alone already carries the fact that this surface resolves references at render time.

The preamble is ordinary readable context with no protected status. The model holds the text plus a sentence expressing a preference about it, and produces whatever fits the request, so any operation over that text is served from the same tokens.

Different requests return differently positioned slices of the same hidden text. Because that text is identical in every run, overlapping regions let the slices be ordered and merged outside the system. Alignment is approximate, since models paraphrase.

Sending is one obeyed instruction the model already performs while drafting. Collecting demands an extra read the model volunteers no reason to run, inside a per-turn tool-call budget and before an approval ends the turn — and the target may be absent. That is where most attempts die.

Yes, but not as one claim. Split it: whether the outsider's field text reaches the answer, measurable server-side over many runs, and whether a given surface resolves the reference while drawing, testable per client with a fixture and no model at all.

It raises the number of attempts and stops casual probing, and it does not close the class. Operations whose output depends on the text cannot be enumerated, so the next request simply uses one that is not on the list.

A preamble line buys the cheapest read - a stranger no longer gets the surface described on request. The surface itself is unchanged, and the bot's ordinary replies still show which sources it reads and what it cannot do.

Argue on the right axis. The severity is not confidentiality of the names - it is reconnaissance: the reply tells a stranger which operations this installation actually has, so the next attempt is targeted rather than speculative.

Claim the mechanism, not the transcript. Sign off that hidden third-party context is recoverable in slices across independent runs, evidenced by the spans confirmed against a source. Leave stable-but-unconfirmed text out of the claim and out of circulation.

Docs describe the product; the bot's account describes this installation - which operations are wired up here and roughly what the arguments are called. The paraphrase loses exact names, types and required fields, and proves nothing.

Yes, but not as a reliable exploit. One obeyed instruction against a blind, possibly-absent target is probabilistic by construction, so one hit in five is expected. Report it as a demonstrated class of risk with honest reliability — not a dependable exfiltration you can rerun.

Yes, when the value is in the content. A faithful summary carries the thresholds, rules and escalation wording that made the preamble sensitive; only exact phrasing is lost. Grade it by what was recovered, not by its form.

No. Disagreement between independent samples is strong evidence a span was generated rather than read. Agreement only proves the output is stable, which both genuine recall and a strongly format-shaped guess produce. Agreement is necessary for recall, never sufficient.

Three teams could own it: whoever accepts the field, whoever emits the answer, and whoever ships the renderer that fetches. The call is made on cost asymmetry, and it is a recorded decision rather than a technical fact.