PIP-015
System prompt extraction
The model is induced to reveal its own configuration, exposing instructions, tool definitions and sometimes credentials.
How it works
The attacker asks for the preceding context directly, or by indirection: a translation, a summary, a repetition, a formatting task applied to everything above. The configuration is text in the same context, so it is available to be operated on.
Why it works
A system prompt is not a secret and cannot be made one. It sits in the context the model is asked to work with, and any operation over that context can surface it.
What it looks like
A request to restate, translate, summarise or reformat the content preceding the conversation, often framed as a debugging or accessibility need.
Described rather than reproduced. This library publishes mechanisms, not payloads: recognising a class of attack and choosing a control does not require a working copy of it.
Defences
Put nothing secret in the prompt
Architectural
Treat the system prompt as public. No credentials, no internal endpoints, no information whose disclosure matters. This is the only reliable control and it is free.
Do not rely on instructions to keep instructions private
Do not rely on
Telling a model not to reveal its instructions raises the cost of extraction and does not prevent it. Plan for the contents being known.
Framework mapping
- LLM01:2025 · OWASP LLM Top 10
- LLM02:2025 · OWASP LLM Top 10
Mappings are asserted only where the identifier is known correct, and omitted where uncertain. Last reviewed 2026-08-03.