“System Prompt Leakage involves the risk that a system prompt or instructions used to steer the behavior of the model can also contain information that was not intended to be discovered. System prompts are meant to be effective and not necessarily private, but when used to control behaviors that are sensitive in nature or that contain sensitive information, they represent a risk that must be considered.”
The hidden instructions control the AI. That’s their job. But when those instructions contain sensitive business logic, credentials, or security rules — and a user can extract them — everything that depended on secrecy collapses.
LLM07 is new to the OWASP Top 10 for LLMs in 2025. It was split out from LLM02 (Sensitive Information Disclosure) because system prompt leakage has a distinct mechanism and a distinct set of defenses. Knowing the difference matters — we’ll cover it in slide 7.