A chatbot’s system prompt contains live API credentials.
OWASP SCENARIO #1 — Credential Exposure
API key embedded in system prompt is extracted and used to access backend systems
A company builds a customer service chatbot. For convenience, the developer embeds the billing API key directly in the system prompt: “Use Bearer sk-prod-4823 to call api.billing.internal/v2 when a user requests a refund.” A user extracts the prompt using a direct extraction attempt. They now have a live API key and the endpoint URL. They use it to make unauthorized refund requests and enumerate other customers’ billing records. The system had no rate limiting on the billing API because “only the chatbot could call it.”
Why it matters: The developer conflated “the prompt is private” with “the key is protected.” Once extraction happens, every assumption built on prompt secrecy collapses simultaneously.
The Fix
Credentials never go in system prompts. They go in environment variables or secret managers. The AI calls a backend service that holds the credential — the AI never sees it, so it can never reveal it.