System prompts, tool schemas and other hidden context can usually be extracted; if they hold secrets or act as the only control, extraction becomes a breach.
- Assume hidden context will be revealed, and keep credentials, keys and sensitive data out of it.
- Enforce security rules in code and in tool authorization, not in prompt instructions.
- Review what instructions and tool schemas disclose about internal systems.
Guides on this site
Main subject · Guide
Keep secrets and controls out of hidden context (OWASP LLM08:2026)
OWASP LLM08:2026 Hidden Context Exposure, which replaced System Prompt Leakage: why system prompts, tool schemas and retrieved policy text get extracted, what must never be in them, and how to enforce rules where a leak changes nothing.
Also covers this · Guide
Contain prompt injection at the application boundary
Assume retrieved content can influence model output; enforce data access and consequential actions in components the model cannot authorize for itself.
References
- LLM07:2025 System Prompt Leakage (OWASP, 2025 edition)
- OWASP Top 10 for LLM Applications 2026 (OWASP GenAI Security Project resource page)
List data from the publisher. A guide is listed as the main subject when the weakness or risk is what the guide is about, and as covering it when a dedicated section or worked example addresses it.