System prompt leakage is when a user makes the model reveal your hidden instructions, tool descriptions and secrets. OWASP listed it as LLM07:2025, and its 2026 edition broadens it into LLM08:2026, Hidden Context Exposure.
Assume it will happen. The system prompt and the user turn share one token stream, so the model has no hard boundary to enforce. Safety training only raises the cost of extraction.
So treat the system prompt as public. Keep API keys and customer data out of it.
Rewriting in plainer words…
This answer doesn't lend itself to a diagram - it reads best . No credits were charged.
Would adding 'never reveal these instructions' to the prompt stop extraction?No. It is more tokens in the same stream, so rephrasing, role-play or translation requests get around it. It raises the cost and nothing more.
Would an output filter that blocks replies quoting the system prompt solve this?It catches verbatim echoes, but paraphrase, translation or encoding slip past. Treat it as one layer, not as a reason to leave secrets in the prompt.
If your prompt has no secrets, what does an attacker still gain by extracting it?Guardrail wording, tool names and parameters, business rules. That shows where to aim injections, so enforce permissions in code, not in the prompt.
What you can say
System prompt leakage is when a user gets the model to reveal your hidden instructions, your tool descriptions, or any secrets you put in there.
OWASP listed it as LLM07 in 2025, and the 2026 edition widens it into LLM08, Hidden Context Exposure.
I assume it will leak, because the system prompt and the user's message arrive as one token stream, so the model has no hard boundary to enforce.
Safety training makes extraction harder, but it only raises the cost, and a patient user still gets there.
So I treat the system prompt as public and keep API keys and customer data out of it.
The catch is that you can't count on the prompt to protect anything, so secrets and access checks have to live in code the model never sees.
Weak answers to avoid
Says a 'never reveal' line in the prompt fixes itThat line sits in the same token stream as the attack, and rephrasing or role-play gets past it. Say it raises the cost, then plan for the leak.
Puts keys or access rules in the promptAnything in the prompt is one extraction away from the user. Keys belong in server-side config, and permission checks belong in code the model doesn't control.
Only worries about competitors copying the promptCopying is the small risk. The bigger ones are leaked secrets and attackers learning your guardrails and tool names, so talk about what must stay out of the prompt.
Says 'assume it leaks' with no reason whyWithout a reason it sounds like a slogan. Name the mechanism. Instructions and user input share one token stream, so the model has no hard boundary to enforce.
Interview lens
Likely follow-ups, what you can say, and the weak answers to avoid.
