This matches what we’ve seen as well — system prompt extraction often doesn’t require jailbreak-style tricks. Simple conversational framing over multiple turns

This matches what we’ve seen as well — system prompt extraction often doesn’t require jailbreak-style tricks. Simple conversational framing over multiple turns is enough. That’s why relying on instruction hierarchy or post-response moderation feels insufficient. Gating inputs before execution ended up being more effective for us.