Prompt Leaking
Prompt leaking is an attack that extracts a model's hidden system prompt, the instructions an application places ahead of user input to shape the model's behavior. By crafting inputs that induce the model to repeat or summarize its own instructions, an attacker can recover proprietary prompt logic, embedded rules, and sometimes secrets that developers wrongly placed in the prompt. It is a specific form of prompt injection focused on disclosure. OWASP tracks system prompt leakage as LLM07 in its Top 10 for LLM applications, because a leaked prompt reveals how an application's controls work and how to get around them.
How prompt leaking happens
An application's system prompt often contains more than tone instructions: routing logic, tool definitions, business rules, and occasionally credentials or internal URLs that never should have been there. A model does not inherently distinguish between instructions it must keep private and content it may reveal. An attacker who asks the model to repeat the text above, or embeds a subtler instruction, can coax the system prompt back out. Once the prompt is exposed, any protective rules it contained are known to the attacker.
How the response path limits the damage
Prompt leaking shows up in the model's output, which means the response is where it can be caught. Inspecting responses for disclosed system-prompt content, and keeping a record of requests that attempt extraction, turns an invisible leak into a governed event. DeepInspect inspects both the request and the response on the HTTP path, applies policy to what the model returns, and logs a per-decision audit record. Keeping secrets out of the system prompt entirely remains the first control; response inspection is the compensating layer when prompt logic itself is sensitive.
Related reading
- AI System Prompt Leakage: What Leaks, How It Leaks, and Where to Stop It
System prompts carry the AI applications instructions, role assignments, tool definitions, retrieved context, and sometimes credentials or routing keys. A leaked system prompt exposes the application logic to an attacker, including the role boundaries, the tool catalog, and any sensitive context the prompt happened to include. The leakage modes are well-understood. The mitigations live at the AI request boundary, not inside the model. This piece walks through the leak surfaces, the demonstrated attack techniques, and the architectural pattern that prevents leakage.
- OWASP LLM07: System Prompt Leakage and Why Secrets in System Prompts Are Always Wrong
OWASP LLM07 covers system prompt leakage: the application embeds secrets, internal policy, or sensitive instructions in the system prompt, and an attacker extracts them through prompt manipulation. The category gets misread as a prompt-injection variant. The actual lesson is architectural: anything the application would not publish should not sit in the system prompt at all. This article walks through the LLM07 mechanism, the leakage techniques that work in practice, and the architectural fix.