LLM07 system prompt leakage: what should you log and alert on?

Log every model request with its prompt version, tool calls and output checks, and alert when an output repeats your instructions, a secret pattern, or role and limit details. OWASP LLM07 starts from a blunt premise: the system prompt is not a secret, so detection should focus on what leaks and what that enables.

What does OWASP say LLM07 is?

OWASP's 2025 entry defines system prompt leakage as the risk that instructions steering a model contain sensitive information that was never meant to be exposed. The page stresses that the danger is less the prompt text and more the weakness it reveals, such as bypassable guardrails, exposed credentials or a visible permission structure. Its own line is the one to pin on the wall: the system prompt should not be considered a secret, nor used as a security control.

That changes what monitoring is for. You are not trying to guarantee nobody ever sees the prompt. You are trying to notice when it was extracted, and to make sure the extraction yields nothing useful.

What should be in each log record?

Keep records that let you reconstruct a conversation without storing more user data than needed.

• A prompt version ID or hash, not the full text, so you know which instructions were live.
• A conversation and user identifier, pseudonymised where your privacy rules require it.
• Each tool call: tool name, arguments shape and result status.
• The output check result: which filters ran and whether any fired.
• Token counts and latency, because unusual lengths often accompany extraction attempts.

Decide the retention period before you start. Logs of prompts and answers often contain personal data, so they fall under your normal privacy and access rules.

Which signals deserve an alert?

OWASP lists four kinds of exposure: sensitive functionality such as keys and database details, internal rules such as transaction limits, filtering criteria, and permissions or user roles. Turn each into a check on the output side.

1. Verbatim echo. Compare outputs against a fingerprint of the system prompt, for example overlapping word sequences. A match above your threshold is an alert.
2. Secret patterns. Scan outputs for key and token formats. Any hit is high severity, and it means a secret is in the prompt, which OWASP says to avoid.
3. Rule disclosure. Flag answers that state limits, role names or filter rules that appear in your instructions.
4. Repeated probing. Count requests per session that ask the model about its instructions, configuration or earlier messages. Alert on bursts, not single curious questions.
5. Tool misuse after probing. Watch for a tool call that deviates from the session's earlier pattern right after instruction related questions.

Tune thresholds on a week of normal traffic first. A noisy rule that fires daily gets muted and then missed.

What matters more than the alerts?

OWASP's mitigations are architectural, and they decide how bad a leak is.

• Keep sensitive data out of prompts. Credentials, database names, roles and limits belong in systems the model cannot read directly.
• Do not rely on prompts for strict behavior. Injection can alter prompts, so enforce rules outside the model.
• Put guardrails outside the LLM. An independent system that inspects output is preferable to training the model to stay quiet.
• Enforce authorization independently. Privilege separation and checks must not be delegated to the model. Use multiple agents with least privilege where tasks need different access.

If you follow those, an alert for a leaked prompt becomes a low severity event, because the prompt holds nothing worth stealing.

What to do

1. Audit your current system prompts and remove any key, connection string, role map or numeric limit.
2. Move those checks into code the model cannot rewrite.
3. Add an output filter and log whether it fired, per request.
4. Store a prompt version hash with each log record.
5. Build the five alerts above, starting with secret patterns and verbatim echo.
6. Review a sample of flagged sessions weekly, and adjust.
7. Add the prompts and the code that backs them to your normal repository review, since a prompt is configuration that changes behavior.

Quick check

Sources

• OWASP GenAI: LLM07:2025 System Prompt Leakage, fetched 18 October 2026

Last reviewed: 18 October 2026.