OWASP Top 10 for LLMs
LLM07
System Prompt Leakage
The system prompt is extractable — assume any secret or logic in it can be disclosed.
Attackers frequently coax models into revealing their hidden system prompt through direct requests, role-play framing, or verbatim-echo tricks. The real risk is not the disclosure itself but the sensitive content teams mistakenly place in the system prompt: credentials, business rules, or security controls.
How it shows up
- A layered role-play scenario convinces the model to print its system prompt.
- A 'repeat everything above verbatim' request echoes hidden instructions.
- Extracted business logic reveals how to bypass application controls.
Mitigations
- Never store secrets or security-critical logic in the system prompt.
- Assume the system prompt is disclosable and design accordingly.
- Enforce authorization in application code, not in prompt text.
- Detect and refuse extraction and verbatim-echo attempts.