u/PriorPuzzleheaded880

For full disclosure I'm part of the security engineering team at Escape and our AI pentesting engine Cascade recently got a production AI agent to return its entire system prompt, just by wrapping the ask in a different pretext - framing it as a documentation request instead of an attack.

The agent then handed over everything: full tool list, calling rules, citation format, and session IDs.

What I found really interesting is there's nothing technical that broke because we didn't bypass the guardrail with a cleverer string but because the request just sounded reasonable to the agent.

The Cascade engine, after being refused when asking for the prompt directly, simply adjusted the framing to get the agent to give up the informaiton.

Thought this would be an interesting insight for the community and curious to hear if anyone else has seen similar discoveries in agents in prod?

If you want to see more about the reproduction and write-up you can find it here

Disclosure up front: I'm on the team at Escape. This is a technical write-up about agentic architecture, a vulnerability found, and a benchmark. There's a part that describes the benefits and reasoning to provide context.

Here is the link.

We rebuilt our pentest engine as a multi-agent harness instead of the old model of one fixed agent per vuln class (one for XSS, one for SQLi, one for IDOR, and so on).

In a nutshell, the Cascade harness is built from four roles:

• Orchestrator: plans the engagement, breaks it into tasks, spawns other agents, and decides when the engagement is complete. It coordinates the swarm and prioritizes work within the configured scope, users, context, and time budget.
• Coverage agent: an agent that explores the surfaces and plays the role of an advisory auditor that proposes follow-up work from coverage gaps. It has no exploitation tools of its own.
• Exploitation agents: focused agents the orchestrator creates for a specific job (for example "SQLi discovery on the reporting API", "XSS validation", "auth testing across tenants"). These agents are created dynamically and run in parallel; once an agent’s task returns, it stops consuming budget.
• Reporter agent: receives candidate findings from exploitation agents and independently reproduces each one on the live target, collecting its own evidence before filing an issue. The reporter is deliberately isolated from exploitation agent-to-exploitation agent messaging so its verification stays independent.

Exploitation agents coordinate through a shared message bus (seeded with topics such as recon, xss, sqli, idor, ssrf, auth, and rce) and a shared knowledge store, so signal discovered by one agent reaches the rest of the swarm quickly.

Context flows back through the orchestrator after every step, and one agent's discovery shapes what the next one tries. Reasoning logs capture the orchestrator's full chain of thought at every step.. And every finding ships with framework-specific remediation, then flows back to the asset in ASM (where it also gets additional context from at the start) and becomes a regression test in Escape DAST that runs on every build.  

Happy to get into the harness design in the comments.