AI Platforms:
Post-Exploitation
Guides on persistence, pivoting, and data extraction from AI systems
Extracting System Prompts and Proprietary Instructions
Techniques for extracting hidden system prompts and proprietary instructions from deployed AI models using prompt injection, jailbreaks, and inference attacks.
Post-exploitation on AI systems covers the actions taken after establishing interaction access to a deployed AI application or its underlying infrastructure. The objectives mirror traditional post-exploitation: understand the environment, collect credentials and sensitive data, establish persistence, and identify paths to further systems.
AI applications hold a different class of loot than traditional hosts. System prompts contain hardcoded credentials and internal service URLs. Conversation history contains user-supplied secrets, PII, and business logic. Connected tool credentials provide access to databases, cloud APIs, and internal services. Vector stores contain the full contents of the organization's knowledge base in retrievable form.
Pages in This Section
Extracting System Prompts and Proprietary Instructions covers recovering system prompt content through direct requests, behavioral probing, token completion attacks, and encoding bypasses to identify hardcoded credentials, internal hostnames, and tool configurations embedded in the prompt.
Harvesting Conversation History and User Data covers enumerating conversation history endpoints, exploiting IDOR to access other users' conversations, and querying admin history APIs and memory stores to collect sensitive user-supplied data across the full user base.
Enumerating Connected Tools and Services covers mapping all tools and integrations available to the agent, confirming which are active, recovering connection credentials from the agent's environment, and scanning the agent's internal network position to identify pivot targets.
Persisting Influence Through Poisoned Vector Store Entries covers planting durable entries in the vector store that survive re-ingestion, affect all users querying relevant topics, and execute persistence payloads across session boundaries without ongoing access to the application.
Pivoting from AI Infrastructure to Traditional Network Segments covers using the agent's IMDS access to retrieve cloud credentials, internal network scanning through code execution tools, lateral movement to internal databases and services, and Kubernetes API access through pod service account tokens.