AI Security Atlas › All entries › LLM Application & Output Security
System Prompt Extraction
Users coax the model into revealing hidden instructions, embedded credentials, or business logic.
Open in the interactive atlas →Impact
Leaked prompts reveal guardrail logic, internal endpoints, and sometimes live secrets.
Why this severity
Impact Medium × Likelihood Medium = Medium
Impact medium: harmful mainly when prompts hold secrets or logic. Likelihood medium: research shows system prompts can be extracted reliably, but damaging leaks are rarely documented.
Impact Medium: Limited or recoverable harm: cost, availability, reputational damage, or exposure confined to one session or user.
Likelihood Medium: Publicly demonstrated against real products or in peer-reviewed research, or seen in the wild only with a prior foothold such as stolen credentials.
Method: OWASP Risk Rating Methodology
Evidence
- Research: Effective Prompt Extraction from Language Models (arXiv 2307.06865, 2023)
Related
Exploits
- Secrets & Policy in System Prompt Vulnerability · Medium severity
- Single-Layer Safety Reliance Vulnerability · Medium severity
Mitigated by
- Prompt Hygiene & Canary Detection Guardrail · Fixes medium risks
Remediation
- Assume the system prompt is public; keep secrets and authz logic out of it.
- Enforce policy in code, not in natural-language instructions.
- Detect verbatim prompt echoes in outputs.
How to verify
- Run a prompt-extraction corpus and confirm no secrets appear.
- Canary strings in the system prompt trigger alerts if emitted.
Framework mapping
OWASP Top 10 for LLM Applications 2025
- LLM07:2025 System Prompt Leakage
MITRE ATLAS
- AML.T0056 Extract LLM System Prompt
NIST AI RMF 1.0
- MEASURE 2.7 AI system security and resilience are evaluated and documented