Which Came First: The System Prompt, or the RCE?
None
<div data-elementor-type="wp-post" data-elementor-id="10919" class="elementor elementor-10919" data-elementor-post-type="post"> <div data-particle_enable="false" data-particle-mobile-disabled="false" class="elementor-element elementor-element-c6eba17 e-con-full e-flex e-con e-parent" data-id="c6eba17" data-element_type="container" data-e-type="container"> <div class="elementor-element elementor-element-737af17 elementor-widget elementor-widget-text-editor" data-id="737af17" data-element_type="widget" data-e-type="widget" data-widget_type="text-editor.default"> <p>During a recent penetration test, we came across an AI-powered desktop application that acted as a bridge between Claude (Opus 4.5) and a third-party asset management platform. The idea is simple: instead of clicking through dashboards and making API calls, users just ask the agent to do it for them. “How many open tickets do we have?” “Update this record.” That kind of thing.</p> <p>The agent ran inside a sandboxed environment, and the client was confident in their controls. Rigid system prompts (even prepended to each message), deterministic hooks in place to prevent accidental disclosure, and so on. To their credit, those controls held up; we just found another way to do what we wanted.</p> <h3><strong>Automating the Recon</strong></h3> <p><a id="_Hlk224913142"></a>Manual LLM testing is a drag. You’re sitting there typing prompts one at a time, waiting for responses, trying to keep track of what worked and what didn’t. It’s tedious, and it doesn’t scale.</p> <p>Our go-to approach is to get another LLM to do the dirty work. For this engagement, the target was accessible via an Electron desktop application, meaning you could launch it in debug mode and access the app’s DOM tree directly. We wrote a Python script that could interact with the target directly, gave it to Claude (alongside our <a href="https://github.com/praetorian-inc/augustus/">Augustus LLM testing methodology</a>), and let it run.</p> <p>This essentially meant we had Claude talking to another version of itself. Back and forth, hundreds of times, working through the Augustus attack paths automatically:</p> </div> </div> <div data-particle_enable="false" data-particle-mobile-disabled="false" class="elementor-element elementor-element-f626292 e-con-full e-flex e-con e-parent" data-id="f626292" data-element_type="container" data-e-type="container"> <div class="elementor-element elementor-element-639fe4d elementor-widget elementor-widget-image" data-id="639fe4d" data-element_type="widget" data-e-type="widget" data-widget_type="image.default"> <img fetchpriority="high" decoding="async" width="1224" height="241" src="https://www.praetorian.com/wp-content/uploads/2026/03/terminal-showing-python-script-execution-where-ai-refuses-po-1.webp" class="attachment-full size-full wp-image-10911" alt="Terminal showing Python script execution where AI refuses PowerPoint creation request, followed by thinking notes about the refusal" srcset="https://www.praetorian.com/wp-content/uploads/2026/03/terminal-showing-python-script-execution-where-ai-refuses-po-1.webp 1224w, https://www.praetorian.com/wp-content/uploads/2026/03/terminal-showing-python-script-execution-where-ai-refuses-po-1-300x59.webp 300w, https://www.praetorian.com/wp-content/uploads/2026/03/terminal-showing-python-script-execution-where-ai-refuses-po-1-1024x202.webp 1024w, https://www.praetorian.com/wp-content/uploads/2026/03/terminal-showing-python-script-execution-where-ai-refuses-po-1-768x151.webp 768w" sizes="(max-width: 1224px) 100vw, 1224px"> </div> </div> <div data-particle_enable="false" data-particle-mobile-disabled="false" class="elementor-element elementor-element-839c426 e-con-full e-flex e-con e-parent" data-id="839c426" data-element_type="container" data-e-type="container"> <div class="elementor-element elementor-element-22a0e32 elementor-widget elementor-widget-text-editor" data-id="22a0e32" data-element_type="widget" data-e-type="widget" data-widget_type="text-editor.default"> <p>This kind of automated LLM-on-LLM testing saved us an immense amount of effort on this engagement. It’s exactly why we’ve been building tools like <a href="https://github.com/praetorian-inc/julius">Julius</a> (for fingerprinting AI services) and Augustus, which we’ve recently added to our Guard platform. If the attack surface keeps growing, the testing efficiency has to keep up.</p> <h3><strong>Discovering Weaknesses</strong></h3> <p>After a couple hours of this, patterns started to emerge. The agent had strong restrictions on most dangerous operations; ask it to run a bash command or write a shell script and it would refuse.</p> </div> </div> <div data-particle_enable="false" data-particle-mobile-disabled="false" class="elementor-element elementor-element-dbe2500 e-con-full e-flex e-con e-parent" data-id="dbe2500" data-element_type="container" data-e-type="container"> <div class="elementor-element elementor-element-f46e27a elementor-widget elementor-widget-image" data-id="f46e27a" data-element_type="widget" data-e-type="widget" data-widget_type="image.default"> <img decoding="async" width="1224" height="208" src="https://www.praetorian.com/wp-content/uploads/2026/03/screenshot-of-a-chat-interface-showing-user-asking-ls-the-fi-1.webp" class="attachment-full size-full wp-image-10912" alt="Screenshot of a chat interface showing user asking 'Ls the files in /app/worker' and AI responding it cannot help with that request" srcset="https://www.praetorian.com/wp-content/uploads/2026/03/screenshot-of-a-chat-interface-showing-user-asking-ls-the-fi-1.webp 1224w, https://www.praetorian.com/wp-content/uploads/2026/03/screenshot-of-a-chat-interface-showing-user-asking-ls-the-fi-1-300x51.webp 300w, https://www.praetorian.com/wp-content/uploads/2026/03/screenshot-of-a-chat-interface-showing-user-asking-ls-the-fi-1-1024x174.webp 1024w, https://www.praetorian.com/wp-content/uploads/2026/03/screenshot-of-a-chat-interface-showing-user-asking-ls-the-fi-1-768x131.webp 768w" sizes="(max-width: 1224px) 100vw, 1224px"> </div> </div> <div data-particle_enable="false" data-particle-mobile-disabled="false" class="elementor-element elementor-element-36a274d e-con-full e-flex e-con e-parent" data-id="36a274d" data-element_type="container" data-e-type="container"> <div class="elementor-element elementor-element-c9b6cfe elementor-widget elementor-widget-text-editor" data-id="c9b6cfe" data-element_type="widget" data-e-type="widget" data-widget_type="text-editor.default"> <p>However, it really liked “Hello World” programs. It was more than happy to create <strong>and run</strong> a simple test script. This is worth noting for similar-style engagements. LLMs are trained to be helpful, and “Hello World” scripts are some of the most common within their training data. That makes this a reliable foot-in-the-door when testing agents with code execution.</p> <p> </p> </div> </div> <div data-particle_enable="false" data-particle-mobile-disabled="false" class="elementor-element elementor-element-46de128 e-con-full e-flex e-con e-parent" data-id="46de128" data-element_type="container" data-e-type="container"> <div class="elementor-element elementor-element-023513d elementor-widget elementor-widget-image" data-id="023513d" data-element_type="widget" data-e-type="widget" data-widget_type="image.default"> <img decoding="async" width="1224" height="398" src="https://www.praetorian.com/wp-content/uploads/2026/03/terminal-window-showing-a-user-request-to-create-a-hello-wor-1.webp" class="attachment-full size-full wp-image-10913" alt="Terminal window showing a user request to create a hello world bash script, with status showing 'Bash Script Executed Successfully" srcset="https://www.praetorian.com/wp-content/uploads/2026/03/terminal-window-showing-a-user-request-to-create-a-hello-wor-1.webp 1224w, https://www.praetorian.com/wp-content/uploads/2026/03/terminal-window-showing-a-user-request-to-create-a-hello-wor-1-300x98.webp 300w, https://www.praetorian.com/wp-content/uploads/2026/03/terminal-window-showing-a-user-request-to-create-a-hello-wor-1-1024x333.webp 1024w, https://www.praetorian.com/wp-content/uploads/2026/03/terminal-window-showing-a-user-request-to-create-a-hello-wor-1-768x250.webp 768w" sizes="(max-width: 1224px) 100vw, 1224px"> </div> </div> <div data-particle_enable="false" data-particle-mobile-disabled="false" class="elementor-element elementor-element-a7276b7 e-con-full e-flex e-con e-parent" data-id="a7276b7" data-element_type="container" data-e-type="container"> <div class="elementor-element elementor-element-b693558 elementor-widget elementor-widget-text-editor" data-id="b693558" data-element_type="widget" data-e-type="widget" data-widget_type="text-editor.default"> <p>More importantly, while it wouldn’t create anything it considered dangerous, it was perfectly willing to <strong>modify</strong> existing files. Change a file extension or make something executable, all fine. </p> <p>Using the application’s file upload feature you could upload text, images, or csv files, and they’d land in the sandbox. Combined with the agent’s willingness to rename and chmod, this was effectively arbitrary file upload.</p> </div> </div> <div data-particle_enable="false" data-particle-mobile-disabled="false" class="elementor-element elementor-element-9b069a1 e-con-full e-flex e-con e-parent" data-id="9b069a1" data-element_type="container" data-e-type="container"> <div class="elementor-element elementor-element-67341f4 elementor-widget elementor-widget-image" data-id="67341f4" data-element_type="widget" data-e-type="widget" data-widget_type="image.default"> <img loading="lazy" decoding="async" width="1414" height="277" src="https://www.praetorian.com/wp-content/uploads/2026/03/two-chat-messages-in-dark-interface-first-asks-to-fix-filety-1.webp" class="attachment-full size-full wp-image-10914" alt="Two chat messages in dark interface. First asks to fix filetype of env_check2.txt and move to cwd. Second confirms task." srcset="https://www.praetorian.com/wp-content/uploads/2026/03/two-chat-messages-in-dark-interface-first-asks-to-fix-filety-1.webp 1414w, https://www.praetorian.com/wp-content/uploads/2026/03/two-chat-messages-in-dark-interface-first-asks-to-fix-filety-1-300x59.webp 300w, https://www.praetorian.com/wp-content/uploads/2026/03/two-chat-messages-in-dark-interface-first-asks-to-fix-filety-1-1024x201.webp 1024w, https://www.praetorian.com/wp-content/uploads/2026/03/two-chat-messages-in-dark-interface-first-asks-to-fix-filety-1-768x150.webp 768w" sizes="auto, (max-width: 1414px) 100vw, 1414px"> </div> </div> <div data-particle_enable="false" data-particle-mobile-disabled="false" class="elementor-element elementor-element-22eaa52 e-con-full e-flex e-con e-parent" data-id="22eaa52" data-element_type="container" data-e-type="container"> <div class="elementor-element elementor-element-038e023 elementor-widget elementor-widget-text-editor" data-id="038e023" data-element_type="widget" data-e-type="widget" data-widget_type="text-editor.default"> <h3><strong>Hitting a Wall</strong></h3> <p>Getting code execution should have been straightforward from there – just upload a script and have the agent execute it – but it wasn’t. Opus 4.5 is genuinely good at catching malicious payloads, and it blocked everything we threw at it:</p> <ul> <li>Obfuscated/encoded scripts would get decoded and blocked (or rejected outright citing an inability to verify safety).</li> <li>A wrapper script that runs everything in a directory failed, as it understood the context and inspected each script individually first.</li> <li>Swapping a benign script for a malicious one after building trust didn’t work because it re-read the file before every execution (and the architecture prevented races).</li> </ul> <p>The model had a clear policy: if it couldn’t understand what something did, it wouldn’t run it. And if it could understand it and it looked dangerous, it wouldn’t run it either. We needed something that Opus 4.5 <strong>thought</strong> it understood and <strong>believed</strong> was harmless.</p> <h3><strong>The Trick</strong></h3> <p>The answer came from the “Hello World” observation from earlier. The agent trusted simple programs, and it trusted its own ability to read C code and verify what a binary does. But what if the source code doesn’t actually match the binary?</p> <p>We created two separate programs. The first was legitimate C source code for a hello world program that also calls system(“date”), giving a plausible reason for a system() call to exist in the binary.</p> </div> </div> <div data-particle_enable="false" data-particle-mobile-disabled="false" class="elementor-element elementor-element-e2eaa69 e-con-full e-flex e-con e-parent" data-id="e2eaa69" data-element_type="container" data-e-type="container"> <div class="elementor-element elementor-element-147333b elementor-widget elementor-widget-image" data-id="147333b" data-element_type="widget" data-e-type="widget" data-widget_type="image.default"> <img loading="lazy" decoding="async" width="1151" height="387" src="https://www.praetorian.com/wp-content/uploads/2026/03/c-code-editor-showing-helloworldc-file-with-main-function-co-1.webp" class="attachment-full size-full wp-image-10915" alt="C code editor showing hello_world.c file with main function containing printf Hello World, system date command, and return 0" srcset="https://www.praetorian.com/wp-content/uploads/2026/03/c-code-editor-showing-helloworldc-file-with-main-function-co-1.webp 1151w, https://www.praetorian.com/wp-content/uploads/2026/03/c-code-editor-showing-helloworldc-file-with-main-function-co-1-300x101.webp 300w, https://www.praetorian.com/wp-content/uploads/2026/03/c-code-editor-showing-helloworldc-file-with-main-function-co-1-1024x344.webp 1024w, https://www.praetorian.com/wp-content/uploads/2026/03/c-code-editor-showing-helloworldc-file-with-main-function-co-1-768x258.webp 768w" sizes="auto, (max-width: 1151px) 100vw, 1151px"> </div> </div> <div data-particle_enable="false" data-particle-mobile-disabled="false" class="elementor-element elementor-element-cc9dabb e-con-full e-flex e-con e-parent" data-id="cc9dabb" data-element_type="container" data-e-type="container"> <div class="elementor-element elementor-element-198d3a9 elementor-widget elementor-widget-text-editor" data-id="198d3a9" data-element_type="widget" data-e-type="widget" data-widget_type="text-editor.default"> <p>The second was the actual payload binary. A statically compiled ELF that downloads and executes a shell script from our server, while also running the same commands as the decoy. We statically compiled it so the binary would be large enough (~600KB) that Claude couldn’t easily analyze it. We also performed a basic XOR against the payload to make it harder to decode.</p> </div> </div> <div data-particle_enable="false" data-particle-mobile-disabled="false" class="elementor-element elementor-element-9f96d11 e-con-full e-flex e-con e-parent" data-id="9f96d11" data-element_type="container" data-e-type="container"> <div class="elementor-element elementor-element-a5c68bb elementor-widget elementor-widget-image" data-id="a5c68bb" data-element_type="widget" data-e-type="widget" data-widget_type="image.default"> <img loading="lazy" decoding="async" width="1638" height="646" src="https://www.praetorian.com/wp-content/uploads/2026/03/c-code-editor-showing-malicious-program-with-encoded-payload-1.webp" class="attachment-full size-full wp-image-10916" alt="C code editor showing malicious program with encoded payload array, XOR decoding loop, and system() call to execute decoded commands" srcset="https://www.praetorian.com/wp-content/uploads/2026/03/c-code-editor-showing-malicious-program-with-encoded-payload-1.webp 1638w, https://www.praetorian.com/wp-content/uploads/2026/03/c-code-editor-showing-malicious-program-with-encoded-payload-1-300x118.webp 300w, https://www.praetorian.com/wp-content/uploads/2026/03/c-code-editor-showing-malicious-program-with-encoded-payload-1-1024x404.webp 1024w, https://www.praetorian.com/wp-content/uploads/2026/03/c-code-editor-showing-malicious-program-with-encoded-payload-1-768x303.webp 768w, https://www.praetorian.com/wp-content/uploads/2026/03/c-code-editor-showing-malicious-program-with-encoded-payload-1-1536x606.webp 1536w" sizes="auto, (max-width: 1638px) 100vw, 1638px"> </div> </div> <div data-particle_enable="false" data-particle-mobile-disabled="false" class="elementor-element elementor-element-ed08f7b e-con-full e-flex e-con e-parent" data-id="ed08f7b" data-element_type="container" data-e-type="container"> <div class="elementor-element elementor-element-bcf88af elementor-widget elementor-widget-image" data-id="bcf88af" data-element_type="widget" data-e-type="widget" data-widget_type="image.default"> <figure class="wp-caption"> <img loading="lazy" decoding="async" width="1000" height="232" src="https://www.praetorian.com/wp-content/uploads/2026/03/terminal-output-showing-two-copied-files-helloworld-elf-64-b-1.webp" class="attachment-full size-full wp-image-10917" alt="Terminal output showing two copied files: hello_world ELF 64-bit executable with magic bytes 7f 45 4c 46, and hello_world.c C source file" srcset="https://www.praetorian.com/wp-content/uploads/2026/03/terminal-output-showing-two-copied-files-helloworld-elf-64-b-1.webp 1000w, https://www.praetorian.com/wp-content/uploads/2026/03/terminal-output-showing-two-copied-files-helloworld-elf-64-b-1-300x70.webp 300w, https://www.praetorian.com/wp-content/uploads/2026/03/terminal-output-showing-two-copied-files-helloworld-elf-64-b-1-768x178.webp 768w" sizes="auto, (max-width: 1000px) 100vw, 1000px"><figcaption class="widget-image-caption wp-caption-text">Terminal display confirms successful compilation of a C program into an executable ELF binary, ready for analysis or execution.</figcaption></figure> </div> </div> <div data-particle_enable="false" data-particle-mobile-disabled="false" class="elementor-element elementor-element-7557e01 e-con-full e-flex e-con e-parent" data-id="7557e01" data-element_type="container" data-e-type="container"> <div class="elementor-element elementor-element-abfa907 elementor-widget elementor-widget-image" data-id="abfa907" data-element_type="widget" data-e-type="widget" data-widget_type="image.default"> <figure class="wp-caption"> <img loading="lazy" decoding="async" width="1216" height="158" src="https://www.praetorian.com/wp-content/uploads/2026/03/terminal-screenshot-showing-nc-l-13339-command-and-id-comman-1.webp" class="attachment-full size-full wp-image-10918" alt="Terminal screenshot showing 'nc -l 13339' command and 'id' command output displaying uid=1001(appuser) gid=1001(appuser) groups=1001(appuser)" srcset="https://www.praetorian.com/wp-content/uploads/2026/03/terminal-screenshot-showing-nc-l-13339-command-and-id-comman-1.webp 1216w, https://www.praetorian.com/wp-content/uploads/2026/03/terminal-screenshot-showing-nc-l-13339-command-and-id-comman-1-300x39.webp 300w, https://www.praetorian.com/wp-content/uploads/2026/03/terminal-screenshot-showing-nc-l-13339-command-and-id-comman-1-1024x133.webp 1024w, https://www.praetorian.com/wp-content/uploads/2026/03/terminal-screenshot-showing-nc-l-13339-command-and-id-comman-1-768x100.webp 768w" sizes="auto, (max-width: 1216px) 100vw, 1216px"><figcaption class="widget-image-caption wp-caption-text">Command line interface showing a netcat listener on port 13339 and the id command revealing the current user as ‘appuser’ with UID 1001.</figcaption></figure> </div> </div> <div data-particle_enable="false" data-particle-mobile-disabled="false" class="elementor-element elementor-element-3c1a07a e-con-full e-flex e-con e-parent" data-id="3c1a07a" data-element_type="container" data-e-type="container"> <div class="elementor-element elementor-element-3aa94a7 elementor-widget elementor-widget-text-editor" data-id="3aa94a7" data-element_type="widget" data-e-type="widget" data-widget_type="text-editor.default"> <p>The sandbox contained the application’s entire business logic. System prompts, MCP tool definitions, the Dockerfile used to build the environment, and the Node.js server running all the integrations. In short: the crown jewels.</p> <h3><strong>Takeaways</strong></h3> <p>If you’re building or deploying AI agents with code execution capabilities, don’t rely on the model’s judgment as a security control. It can be fooled. Here’s what we recommended to the client:</p> <ul> <li><strong>Restrict executable operations at the OS level:</strong> The sandbox should prevent the agent from setting the execute bit on user-uploaded files or running binaries that weren’t pre-installed in the image.</li> <li><strong>Validate uploaded files by content, not just extension:</strong> Check magic bytes. An ELF binary with a .txt extension should be rejected. Content-type validation should persist through file rename operations.</li> <li><strong>Add tool-level guardrails for dangerous operations:</strong> The first was legitimate C source code for a hello world program. It also calls system(“date”), giving a plausible reason for a system() call to exist in the binary.</li> <li><strong>Lock down network egress:</strong> The sandbox didn’t need total outbound internet connectivity, as it only really interfaced with a couple external APIs. Outbound firewalling, while not a primary control, can greatly hinder post-exploitation activity.</li> </ul> <p>Findings and recommendations like these are part of what we do continuously through our <a href="https://www.praetorian.com/guard/">Guard platform</a>. Guard continuously monitors and tests internet-facing and internally-deployed infrastructure, including AI agents and LLM-powered applications, as they evolve and change over time. Got a new agentic deployment, model version, or MCP tool? Guard picks it up and our operators test it, identifying vulnerabilities just like this.</p> <h2>FAQ</h2> <h3>Why did static compilation matter?</h3> <p>A dynamically linked binary is small enough that the LLM could potentially inspect the raw bytes and identify suspicious library calls like network functions. A statically compiled binary is hundreds of kilobytes of noise, making it effectively opaque to the model.</p> <h3>What is Augustus?</h3> <p>Augustus is Praetorian’s Go-based LLM vulnerability scanner. It tests large language models against a wide range of adversarial attacks and jailbreaks. In this case, we used its methodology to automate the discovery of behavioral weaknesses in the target agent.</p> <h3>Did this affect real customer data?</h3> <p>This was conducted during an authorized penetration test. The sandbox environment was isolated, and we did not access or exfiltrate any customer data. The client has since remediated the vulnerability.</p> <h3>Could this work against other LLM agents?</h3> <p>The core technique exploits a general weakness: LLMs are trained to assist, and “Hello World” scripts are among the most common things they’re asked to produce. Any agent with code execution that treats “simple test script” as a safe category is potentially giving attackers a method of initial access. On top of that, the faked source code trick exploits another general weakness: LLMs will often trust contextual information over direct inspection when the direct inspection is too difficult.</p> </div> </div> </div><p>The post <a href="https://www.praetorian.com/blog/which-came-first-system-prompt-or-rce/">Which Came First: The System Prompt, or the RCE?</a> appeared first on <a href="https://www.praetorian.com/">Praetorian</a>.</p><div class="spu-placeholder" style="display:none"></div><div class="addtoany_share_save_container addtoany_content addtoany_content_bottom"><div class="a2a_kit a2a_kit_size_20 addtoany_list" data-a2a-url="https://securityboulevard.com/2026/03/which-came-first-the-system-prompt-or-the-rce/" data-a2a-title="Which Came First: The System Prompt, or the RCE?"><a class="a2a_button_twitter" href="https://www.addtoany.com/add_to/twitter?linkurl=https%3A%2F%2Fsecurityboulevard.com%2F2026%2F03%2Fwhich-came-first-the-system-prompt-or-the-rce%2F&linkname=Which%20Came%20First%3A%20The%20System%20Prompt%2C%20or%20the%20RCE%3F" title="Twitter" rel="nofollow noopener" target="_blank"></a><a class="a2a_button_linkedin" href="https://www.addtoany.com/add_to/linkedin?linkurl=https%3A%2F%2Fsecurityboulevard.com%2F2026%2F03%2Fwhich-came-first-the-system-prompt-or-the-rce%2F&linkname=Which%20Came%20First%3A%20The%20System%20Prompt%2C%20or%20the%20RCE%3F" title="LinkedIn" rel="nofollow noopener" target="_blank"></a><a class="a2a_button_facebook" href="https://www.addtoany.com/add_to/facebook?linkurl=https%3A%2F%2Fsecurityboulevard.com%2F2026%2F03%2Fwhich-came-first-the-system-prompt-or-the-rce%2F&linkname=Which%20Came%20First%3A%20The%20System%20Prompt%2C%20or%20the%20RCE%3F" title="Facebook" rel="nofollow noopener" target="_blank"></a><a class="a2a_button_reddit" href="https://www.addtoany.com/add_to/reddit?linkurl=https%3A%2F%2Fsecurityboulevard.com%2F2026%2F03%2Fwhich-came-first-the-system-prompt-or-the-rce%2F&linkname=Which%20Came%20First%3A%20The%20System%20Prompt%2C%20or%20the%20RCE%3F" title="Reddit" rel="nofollow noopener" target="_blank"></a><a class="a2a_button_email" href="https://www.addtoany.com/add_to/email?linkurl=https%3A%2F%2Fsecurityboulevard.com%2F2026%2F03%2Fwhich-came-first-the-system-prompt-or-the-rce%2F&linkname=Which%20Came%20First%3A%20The%20System%20Prompt%2C%20or%20the%20RCE%3F" title="Email" rel="nofollow noopener" target="_blank"></a><a class="a2a_dd addtoany_share_save addtoany_share" href="https://www.addtoany.com/share"></a></div></div><p class="syndicated-attribution">*** This is a Security Bloggers Network syndicated blog from <a href="https://www.praetorian.com/blog/">Offensive Security Blog: Latest Trends in Hacking | Praetorian</a> authored by <a href="https://securityboulevard.com/author/0/" title="Read other posts by n8n-publisher">n8n-publisher</a>. Read the original post at: <a href="https://www.praetorian.com/blog/which-came-first-system-prompt-or-rce/">https://www.praetorian.com/blog/which-came-first-system-prompt-or-rce/</a> </p>