We introduce prompt cloning, a new class of black-box attacks that reconstruct system prompt functionality without accessing or extracting its actual text. Unlike traditional prompt leakage, prompt cloning aims to replicate the behavioral effect of the original prompt. Our core insight is that, even under strong alignment training and prompt-level defenses, system prompts leave observable behavioral traces in model outputs. We show that these behaviors can be decomposed into key semantic elements and selectively exposed using harmless, element-sensitive queries. By aggregating these signals, we reconstruct behaviorally equivalent prompts that closely mimic the original. Experiments across real-world LLM applications—under the strongest available prompt defenses—demonstrate that our cloned prompts achieve up to 85% semantic similarity, improving over base LLMs by up to 8%. These results reveal a critical weakness in current prompt protection practices: hiding prompt text is not enough. Our findings call for rethinking prompt security in behavior-aware terms.