The system prompt is not a secret
OWASP lists System Prompt Leakage as its own entry in the LLM Top 10. A system prompt is input to a model that generates text about its input — assume any sufficiently determined user can recover it, and design as if it were published.
Why it is like this
There is no enforcement boundary between instruction and output. The same mechanism that lets the model follow the prompt lets it describe it.
Not to be confused with
A configuration file. The real failure is not the leak itself but what people put in there: credentials, connection strings, internal URLs, business rules that constitute the secret rather than describing it.
In practice
If leaking your system prompt would be a security incident, the incident already exists — it is just not public yet.
Source: OWASP Top 10 for Large Language Model Applications, 2025 — LLM07:2025 System Prompt Leakage. Read on .
The OWASP Top 10 for LLM Applications is © the OWASP Foundation and published under a Creative Commons licence; NIST AI 600-1 is a US Government work in the public domain. These cards are independent commentary written in our own words. ytyk.org is not affiliated with or endorsed by the OWASP Foundation or NIST.
Predict Check yourself
A system prompt contains an internal API key so the model can mention it to a downstream tool. What is the right reading?
Show the answer
The key should be treated as already compromised — a system prompt is recoverable, and secrets belong in the execution layer, never in the prompt.
An instruction not to reveal something is not an access control. The model has no mechanism to enforce it.