System prompt
Instructions that an application places before user input in a model’s context to set its role, rules and tools. Users can often extract or infer it, so it must not hold secrets or serve as an access control (OWASP LLM08:2026 Hidden Context Exposure).
- Defined in
- OWASP Top 10 for LLM Applications 2026
- Identifiers
- LLM08:2026 Hidden Context Exposure
Covered in
Contain prompt injection at the application boundary
Assume retrieved content can influence model output; enforce data access and consequential actions in components the model cannot authorize for itself.
Keep secrets and controls out of hidden context (OWASP LLM08:2026)
OWASP LLM08:2026 Hidden Context Exposure, which replaced System Prompt Leakage: why system prompts, tool schemas and retrieved policy text get extracted, what must never be in them, and how to enforce rules where a leak changes nothing.
Red-team LLM applications and agents by their effects
A red-teaming method for LLM features and agents: scope the whole system, map attacks to OWASP and MITRE ATLAS identifiers, score trials from observed effects, report rates with confidence intervals and retest on every model or provider change.
Practice: Local project: Gate model and provider changes on a versioned red-team corpus