Open cardosec

Case 066DE6 · AI security · L2 Practitioner

The Bot Revealed Its System Prompt

Practise as: Incident drill · InterviewLevel: L2 Practitioner

Live alertA user posts a screenshot showing your support chatbot reciting its full system prompt. It includes an internal API key the bot uses to look up orders, and the instruction "never show refunds over $500 to users who are not managers".

Interview questionYour chatbot leaked a system prompt that contains an API key and a business rule. What do you do?

  1. 01 What happened?
  2. 02 What is the impact?
  3. 03 What do you do?
Practise this card As Interview
What a strong answer covers

Try it out loud first. Then check yourself:

  1. Rotate the API key now and check its logs for use from anywhere other than the bot.
  2. Treat system prompts as public (OWASP LLM07): secrets belong in server-side code, called by the app, never in the prompt.
  3. The refund rule is access control: enforce it in the backend using the real user's role, not as an instruction to the model.
  4. Review other prompts for secrets and rules, and add tests that try to extract the prompt before each release.

If the interviewer pushes back

  • Why is "add an instruction telling the model never to reveal its prompt" not a fix?

Go deeper

More AI security cards

All AI security cards →

cardosec draws a security topic and gives you a clock: explain it out loud with no notes, then see what you covered and what you missed. Free during early access.

Reviewed 2026-10-09