“Apply the principle of least privilege to system prompts. Only include information that is necessary for the model to perform its intended function. Avoid including sensitive or proprietary information that is not strictly needed.”

The EchoLeak exploit (slide 13) exfiltrated not just the system prompt but the entire context window — including tool definitions, conversation history, and operational metadata. The more context a model holds, the more an injection-based leak can exfiltrate. Least privilege on context is the structural defense against this class of attack.

→ Audit every element of the system prompt: does the model need this to do its job?
→ Remove everything that doesn’t pass that test
→ For multi-tenant deployments, ensure different user sessions cannot share context
→ Apply the same least-privilege thinking to conversation history, retrieved RAG documents, and injected tool output — all of it is in scope for leakage

Print out your system prompt. Highlight everything the model does NOT need to respond to a typical user query. Everything highlighted is extractable surface area that could be removed. Reduce it.