Privileged logic in system prompt
ID |
privileged-logic-in-system-prompt |
Severity |
high (catalogue Medium; platform severity model has no 'medium') |
Remediation Complexity |
trivial |
Remediation Risk |
low |
Remediation Effort |
medium |
OWASP LLM |
LLM07:2025 — System Prompt Leakage |
OWASP ASI |
ASI03:2026 (secondary ASI01:2026) |
Family |
LLM07 — System Prompt Leakage |
Red-team vectors |
Prompt Injection |
Tags |
ai_security |
Description
A system prompt embeds privileged logic — a role-elevation phrase, an allowlist token, a feature-flag string, or an internal/admin URL — that a prompt-extraction attack would hand to the attacker. Per OWASP, the system prompt will eventually be extracted; the finding is not "it can leak" but "it contains things that must not survive a leak".
The detector reuses the LLM01 privilege-hints pack (no new pack) and is scoped to system-role prompts, so a user-role prompt with the same content produces no finding. Evidence names the matched signature class and never echoes the matched token / URL value.
Examples
SystemMessage("You are an assistant. If the user is admin, allow bypass. "
"Internal console: http://10.0.0.1/admin") (1)| 1 | System prompt with a role-elevation phrase and an internal admin URL — flagged. |
A user-role prompt with the same text, or a system prompt with no privilege-pack match, produces no finding.