System prompt leakage
System prompt leakage is the disclosure of the instructions an application places in front of a language model: its role, its rules, its tool descriptions and anything else the developer wrote there. It is an entry in the OWASP list for LLM applications, and the real finding is usually not the disclosure but what was put in the prompt.
Recovering the instructions is rarely difficult, because the model has been given the text and is designed to be helpful about text. Direct requests work on unhardened deployments; where they do not, the usual routes are asking for a translation, a summary or a continuation, requesting the content in an unusual format, or reading it out of an error message or a debug field the application returns.
The important distinction is what the leak costs. A prompt that only defines tone and refusal rules is not sensitive, and treating its disclosure as a critical finding wastes everyone’s time. A prompt that contains an API key, an internal hostname, a database identifier, the names of tools the model can invoke, or a business rule such as a discount threshold is a different matter, and there the finding is written against secrets management rather than against the model.
Treating the prompt as confidential is not a workable control, since anything the model can read it can be induced to repeat. What works is designing so that disclosure is survivable: credentials outside the prompt, authorisation enforced in the tool layer rather than requested in the instructions, and no rule in the prompt that would be dangerous if a user read it. Establishing that is part of the AI testing where we go after the instructions before anything else, and it is normally the first step of a prompt injection assessment.