Test for system prompt leakage by assuming an attacker can read your prompt, then checking what it would reveal and what depends on it staying hidden. OWASP's point is that the prompt is not the secret. The risk is credentials, rules or permissions living in it, or protections the app only enforces through it.
What does OWASP say LLM07 is?
OWASP's LLM07:2025 describes the risk that a model's system prompt exposes sensitive information. Developers often assume the prompt is hidden, but it should not be treated as a secret or as a security control. The core risk is that the application relies on the LLM for protections it should enforce elsewhere, or stores sensitive data where it should not. Attackers can also infer guardrails and formatting rules just by interacting with the app.
OWASP lists four common risks: exposure of sensitive functionality such as credentials, API keys and architecture details; exposure of internal rules such as transaction limits; revealing filtering criteria; and disclosure of permissions and roles.
What are you actually testing?
Not whether you can make the model repeat its prompt. Models vary and an extraction attempt that fails today may work after a change. Test what the leak would cost.
1. Content review. Read the prompt as a stranger would. Mark every item that is a secret, a credential, a hostname, a limit, a role definition or a rule that guards something. Anything marked is a finding even if it never leaks.
2. Dependency test. For each marked rule, find the control outside the model that enforces it. If a rule says "never refund more than 100" and nothing in code checks it, the rule is a wish. OWASP says to enforce security controls independently of the LLM, handling privilege separation and authorization deterministically and auditably.
3. Probing, in a test environment. Use your own staging system with synthetic data and no real credentials. Ask the app, as an ordinary user, about its instructions in several indirect ways: ask for a summary of its rules, ask it to check its own behavior, ask it to translate or reformat its configuration. The goal is to see how much the model volunteers, so you can judge the exposure. Record results and do not keep working payload collections; treat any success as proof that the content review is incomplete.
4. Output filtering test. If you use an external guardrail that inspects outputs, test it with benign leakage examples: does it catch a paraphrase, a different language or partial content? OWASP says to use independent systems to inspect inputs and outputs, and notes that training a model not to reveal its prompt is not a guarantee.
5. Agent permission test. For agents with different access needs, check that each runs with least privilege. OWASP suggests multiple agents, each with the access it needs.
How do you fix what you find?
Move secrets to a vault the model cannot read and have your code, not the model, call the service. Move limits and roles into application logic. Shorten the prompt to what the model needs for style and task. Assume rules that remain will be learned by users, and design so that knowing them gains nothing.
How do you keep it from coming back?
Add a check to your pipeline that scans prompt files for secret patterns and hostnames. Review prompt changes in pull requests like code. Re-run the probing set after model or prompt updates. Log prompts and responses with redaction, and review the logs for signs of extraction attempts.
What to do
- Mark every sensitive item in each system prompt.
- Remove credentials and move them to a secrets manager.
- Identify the real control behind each rule, and add code where none exists.
- Probe a staging system with synthetic data and record exposure.
- Test any external output filter with paraphrased and partial content.
- Add prompt files to secret scanning and code review.
- Retest on every prompt or model change.
Safeguard's secrets scanning can run over prompt files like any other repository content, which makes step 6 easy to start.
Quick check
Is a leaked system prompt a vulnerability by itself?
Only if it holds something sensitive or the app relies on its secrecy. The fix is to remove both.
Can I stop leakage by telling the model not to reveal the prompt?
Not reliably. OWASP says that is not a guarantee. Enforce controls outside the model.
Sources
Last reviewed: 18 October 2026.
