Security through obscurity means relying on attackers not knowing how your system works. It fails because: (1) attackers can probe, (2) models can be prompted to repeat their instructions, and (3) a model that knows your prompt will tell someone who asks the right way.
“Developers should understand that the system prompt is not a secure storage mechanism.” The mitigation is not better prompt hiding — it’s designing systems that don’t depend on prompt confidentiality for security.
In 2025, GitHub hosts entire repositories dedicated to archiving extracted system prompts from ChatGPT, Claude, Gemini, Copilot, Perplexity, and dozens of others. If a model has seen its prompt, a determined user can likely get it. The question is not whether it can be extracted — it’s whether that extraction causes damage.
Assume your system prompt is public. Design accordingly. If the leaked prompt gives an attacker nothing dangerous, you’ve solved LLM07.