For Heads-of · Practitioner
Hidden Context Exposure
Also known as: system prompt leakage · prompt leakage · LLM08
The exposure of content an AI application placed in a model's context on the assumption users could not see it: system prompts, retrieved documents, schemas, policy logic or other users' data. It is LLM08 in the OWASP Top 10 for LLM Applications 2026, which renamed and broadened the 2025 item system prompt leakage.
- OWASP
- LLM08
- system prompt
- RAG
- data leakage
Definition
Anything in a model's context can, in principle, be repeated back to a user who asks the right way. Hidden context exposure is the failure that follows when an application treats the context as private: instructions revealing business rules, credentials embedded in a prompt, retrieved documents the user was not entitled to see.
Why OWASP broadened it
The 2025 item, system prompt leakage, covered the system prompt alone. Retrieval and agents put far more into the context than a system prompt, and the risk is the same for all of it. The rule that follows is simple: never put anything in a model's context that the user is not allowed to see, because no instruction will reliably keep it there.
Where to go next
This entry defines the term. The register entries hidden context exposure and, under the older name, system prompt leakage set out the controls, including system prompt hardening and vector store and embedding access controls.
Sources
Related Terms
OWASP Top 10 for LLM Applications
The OWASP GenAI Security Project's ranked list of the ten most critical security risks in applications built on large language models. The 2026 edition, published in August 2026, is the closest thing the field has to a shared vocabulary for LLM application security, and every item on it maps to an entry in this site's risk register.
Prompt Engineering
The practice of crafting and refining prompts to steer language models towards the outputs wanted, treating the prompt itself as a design problem.
Prompt Injection
An attack in which untrusted content reaching a language model is interpreted as instructions rather than data, causing the model to act on an attacker's intent instead of the operator's. It is a property of how the application assembles its context, not a flaw in any particular model.
Retrieval-Augmented Generation (RAG)
A technique in which a language model retrieves relevant documents or data before generating a response, grounding its output in source material rather than in its training data alone.