“Avoid including sensitive information in system prompts. Assume that any information placed within a system prompt could be accessible to a sophisticated user, even if precautions are taken.”
The Scenario 1 chatbot (slide 14) is a direct example: an API key embedded in the prompt became the attack surface. The EchoLeak exploit (slide 13) shows the same risk at scale β any context the model holds is extractable. If credentials are in the prompt, they are exfiltrable.
β All credentials live in environment variables or secret managers (AWS Secrets Manager, HashiCorp Vault, Azure Key Vault)
β The AI calls a backend service that retrieves and uses credentials β the AI never handles them directly
β Internal URLs, admin endpoints, and service names stay out of the prompt entirely
β Treat the system prompt as a public document when deciding what to put in it
Read your own system prompt as if you were a competitor who just extracted it. Ask: does anything in here give an attacker credentials, endpoints, or bypass conditions? If yes, move it out before you ship.
Ask your team whether any credentials, API keys, or business logic secrets are stored inside your AI system prompts. If the system prompt leaks β and there are many ways it can β those secrets leak with it.