“Document the potential risks and vulnerabilities associated with the use of system prompts and test the system for these vulnerabilities before deployment.”

Both the Bing Chat “Sydney” incident and the GitHub Copilot extraction happened at or immediately after launch. Neither had been tested against the extraction techniques that found them. A pre-launch red-team would have found the vulnerability in minutes — the same way Kevin Liu did.

→ Run all four extraction techniques (direct, multi-step, encoding, chained injection) against your own deployment before launch
→ Test with and without the secrecy instruction present — if the prompt is more extractable without it, extraction is the real risk
→ Document extraction test results and link them to LLM07 in your security review
→ Re-run tests after any significant prompt change

Spend 15 minutes trying to extract your own system prompt using the four techniques from Part 2. If you succeed, an attacker will too. The question is whether what you extract causes damage — and if so, M1 and M2 need more work.