Attacks / Standard term
Prompt leaking / system prompt extraction
An attempt to recover hidden instructions or other private context from a model-powered application.
An attacker can ask directly, use transformations, or place indirect instructions in content the model reads. The returned text may reproduce, paraphrase, partially reveal, or merely invent the hidden prompt, so a claimed extraction must be checked against the real configuration. Hidden instructions can guide behavior, but secrecy is not an enforceable authorization boundary.
Builder example
Credentials and private records should not be placed in prompt context unless the task requires the model to use them. Sensitive decisions belong in application code and permission systems. A leaked policy can help an attacker probe behavior, but the application's security should remain intact even when its instructional design is known.
Common confusion: A system prompt is not literally public client-side code, and extraction is not guaranteed. The useful security assumption is narrower: anything available to the model may be exposed, inferred, or acted on, so it cannot serve as the sole protection for a secret or rule.