OWASP Top 10 for LLM Applications, 2025
LLM07: System Prompt Leakage
System prompt leakage is the risk that the instructions you give a model reveal something sensitive, because attackers can often get a model to disclose them. OWASP's point is that the prompt itself should not be treated as a secret or as a security control.
System Prompt Leakage in more detail
The real danger is the weakness behind the leak: credentials or tokens stored in the prompt, internal business rules, a map of what the application filters, or the role and permission structure. Attackers can also infer much of a prompt's guardrails and formatting rules just by using the application. The fix is to keep sensitive data out of prompts and enforce behavior and permissions in systems outside the model. Output checks by an independent guardrail also help catch a prompt that is about to be disclosed.
The risk and its name come from OWASP; the summary, examples and controls on this page are our plain-English reading of OWASP's page. Source: Source, checked October 21, 2026: genai.owasp.org (opens in a new tab)
How it shows up
- A prompt contains API keys, database credentials or user tokens that an attacker can read.
- A prompt states internal decision rules, such as transaction or loan limits, that can then be worked around.
- A prompt lists the content it blocks, which gives an attacker a map of what to evade.
- A prompt describes user roles and permission levels, which helps with privilege escalation.
Controls that reduce it
- Keep credentials, database names, roles and permission structures out of system prompts.
- Do not rely on the prompt for strict behavior control, because prompt injection can change it.
- Use independent guardrails that inspect model outputs for compliance.
- Enforce privilege separation and authorization outside the model, with deterministic checks.
- Where agents need different access levels, use separate agents with least-privilege permissions.
Controls reduce risk, they do not remove it
No single control covers system prompt leakage on its own. Combine controls, and treat any tool as one layer.
Categories that address it
Our analysisThese are the directory categories whose tools we score on this risk. The mapping is our analysis.
Layers that address this risk
Our AI security layers are an editorial model, not a standard. Source states means OWASP's own text for LLM07 names the control the layer delivers. Our analysis means we drew the link.
- L4 Testing and red teaming Our analysis
- L5 Data protection Our analysis
- L6 Runtime guardrails Source states
- L7 Agent and tool access Source states
Tools mapped to LLM07
Our analysis8 tools are mapped. Each tool is mapped only where a documented capability supports it. Open a tool page to see the capability and its source. Coverage Score compares tools within one category.
| Tool | Type | Deployment | Pricing model | OWASP risks | Coverage Score | Last reviewed |
|---|---|---|---|---|---|---|
| SpikeeReversec · Red teaming | Open sourceApache-2.0 |
| Free |
| 69 out of 100 | |
| Evo AI-SPMSnyk · AI-SPM | Commercial |
| Usage-based |
| 64 out of 100 | |
| MindgardMindgard · Red teaming | Commercial |
| Not published |
| 59 out of 100 | |
| Lakera GuardCheck Point (Lakera) · Guardrails Now Check Point AI Guardrails | Commercial |
| Not published |
| 57 out of 100 | |
| promptmaputkusen · Red teaming | Open sourceGPL-3.0 |
| Free |
| 56 out of 100 | |
| Vigildeadbits · Guardrails | Open sourceApache-2.0 |
| Free |
| 48 out of 100 | |
| Lakera RedCheck Point (Lakera) · Red teaming | Commercial |
| Contact sales |
| 45 out of 100 | |
| RebuffPalo Alto Networks (Protect AI) · Guardrails Archived | Open sourceApache-2.0 |
| Free |
| 42 out of 100 |
No tools match these filters. Clear a filter to see more.
Why each tool is mapped
- Spikee: Ships a seed set aimed at system message extraction.
- Evo AI-SPM: System prompt and tool extraction are test goals that Snyk maps to LLM07.
- Mindgard: Reconnaissance command that tries to extract the target's system prompt.
- Lakera Guard: Data leakage defenses include system prompt leakage.
- promptmap: Runs prompt stealing rules that try to extract the system prompt.
- Vigil: Canary tokens flag prompt leakage.
- Lakera Red: Context extraction tests try to pull out hidden system prompts.
- Rebuff: Canary tokens flag when prompt content leaks into a response.