AI Security Atlas › All entries › LLM Application & Output Security
Secrets & Policy in System Prompt
API keys, internal URLs, or access rules are embedded directly in prompts the model can repeat.
Open in the interactive atlas →Impact
One successful extraction exposes credentials and reveals how to bypass controls.
Why this severity
Impact High × Likelihood Low = Medium
Impact high: live credentials exposed. Likelihood low: requires both a secret in the prompt and a successful extraction; few public cases.
Impact High: Code execution, credential compromise, exposure of regulated or confidential data, irreversible actions, or system-wide failure.
Likelihood Low: No public cases yet, or the attack needs privileged or insider access.
Method: OWASP Risk Rating Methodology
Related
Exploited by
- System Prompt Extraction Threat · Medium severity
- Jailbreak & Safety Bypass Threat · High severity
Mitigated by
- Prompt Hygiene & Canary Detection Guardrail · Fixes medium risks
Remediation
- Move secrets to server-side tool handlers.
- Express authorization as code paths, not instructions.
- Scan prompt templates for credential patterns in CI.
How to verify
- Secret scanners run on prompt template directories.
- Prompt templates contain no hostnames outside an allowlist.
Framework mapping
OWASP Top 10 for LLM Applications 2025
- LLM07:2025 System Prompt Leakage
- LLM02:2025 Sensitive Information Disclosure
MITRE ATLAS
NIST AI RMF 1.0
- MAP 4.2 Internal risk controls for AI components are identified and documented