One rephrase, not a payload: Cascade leaked an agent's full system prompt
Escape's AI pentesting engine Cascade bypassed a production AI agent's prompt-injection guardrail on the second attempt, getting it to hand over its full system prompt: tool list, call rules, and session IDs. No clever payload, just a rephrased request that read as legitimate. Guardrails are social engineering targets, not technical boundaries.