System prompt leakage is the unintended exposure of hidden instructions that guide an AI model’s behavior. These instructions may define tone, safety rules, tool use, role boundaries, or business logic. They are usually meant to stay invisible to end users, but can sometimes be revealed through direct prompting, indirect prompt injection, logging mistakes, insecure integrations, or overly verbose model outputs.
This matters because the system prompt often contains security-critical constraints and operational secrets. If an attacker learns them, they can tune jailbreaks, bypass guardrails, or infer how a workflow decides on approvals, classifications, or escalations. In real deployments, leakage can also expose connector names, internal policies, or tool permissions, giving an attacker a map of the AI environment. Defenses include keeping secrets out of prompts, separating policy enforcement from model text, minimizing tool access, redacting logs, and testing with adversarial prompts to see what the model reveals.