Hidden context exposure
The extraction, inference or reconstruction of what an LLM application puts in the model’s context but does not show users, such as the system prompt, developer instructions, tool schemas and retrieved policy text (OWASP LLM08:2026, which replaced System Prompt Leakage). Treat that context as public: keep credentials out of it and enforce rules in code.
- Also called
- system prompt leakage · prompt leakage
- Defined in
- OWASP Top 10 for LLM Applications 2026
- Identifiers
- LLM08:2026 Hidden Context Exposure
Covered in
Keep secrets and controls out of hidden context (OWASP LLM08:2026)
OWASP LLM08:2026 Hidden Context Exposure, which replaced System Prompt Leakage: why system prompts, tool schemas and retrieved policy text get extracted, what must never be in them, and how to enforce rules where a leak changes nothing.
Contain prompt injection at the application boundary
Assume retrieved content can influence model output; enforce data access and consequential actions in components the model cannot authorize for itself.
Red-team LLM applications and agents by their effects
A red-teaming method for LLM features and agents: scope the whole system, map attacks to OWASP and MITRE ATLAS identifiers, score trials from observed effects, report rates with confidence intervals and retest on every model or provider change.
Practice: Local project: Gate model and provider changes on a versioned red-team corpus