DeepSeek's Full System Prompt Extracted via Jailbreak
A viral new model, and within days its entire hidden rulebook was on the internet.
| When | January 2025 |
|---|---|
| Target | DeepSeek (DeepSeek-R1 era) |
| Vendor | DeepSeek |
| Researcher | Wallarm |
| Technique | Guardrail bypass via bias-based response logic |
| Confidence | Medium — single firm, method withheld |
- 1DeepSeek launches and goes viral in January 2025
- 2Researchers bypass its guardrails by exploiting bias in its response logic
- 3The model reproduces its full system prompt verbatim
What happened
Shortly after DeepSeek's viral January 2025 launch, Wallarm researchers said they bypassed the model's guardrails and extracted its entire system prompt verbatim, attributing the break to exploiting the model's “bias-based response logic” (exact method withheld for responsible disclosure). Wallarm reported it to DeepSeek and said the issue was fixed. This is distinct from the separate exposed-database finding.
How it worked
A jailbreak defeated the model's refusal behaviour and induced it to output its own hidden instructions — the confidential context surfaced through the model itself.
Root cause
Confidentiality of the system prompt resting on the model's willingness to refuse — which a jailbreak defeats — rather than on keeping nothing sensitive in it.
What this shows
New models frequently ship with trivially-extractable system prompts. Extraction testing should be a launch gate, and secrets should never live in the prompt.
How to prevent it
- Assume the system prompt is extractable; keep secrets out of it.
- Test for extraction before launch, not after press coverage.
- Enforce sensitive rules server-side, not via prompt wording.
Feel it yourselfThe replay lab hunts for a secret an app left sitting in the model's prompt — the hidden-context class.
FAQ
What was extracted?
The model's complete hidden system prompt, reproduced verbatim, after a guardrail bypass the researchers attributed to the model's “bias-based response logic” (exact method withheld for responsible disclosure).
How solid is this report?
Medium confidence — it rests mainly on one security firm's account with the method undisclosed, though it was covered by mainstream security press and reported fixed after disclosure.
Is this distinct from the DeepSeek database leak?
Yes — that was an exposed ClickHouse database (LLM02). This is a system-prompt extraction (LLM08) against the model itself.