Threat dossier · P2
System prompt leakage
Agent system prompts encode policy, tool inventories, and occasionally secrets; leaking them turns a hardened target into a documented one.
Direct answer
What is system prompt leakage?
System prompt leakage exposes the instructions — and sometimes credentials — that steer an agent, handing attackers the exact rules, tool inventory, and guardrails they need to craft a bypass.
Coverage statements below are limited to the current HOL Guard support contract and do not imply universal model or harness protection.
Representative attack path
Defensive model only. This sequence omits weaponized payloads and is not attributed to a specific incident unless a source explicitly says so.
Step 1
The agent is induced or allowed to reveal its instructions.
Step 2
The prompt contains policy logic, tool lists, or sensitive values.
Step 3
The attacker crafts input that exploits the revealed rules.
Step 4
A sensitive action is requested inside the newly understood boundary.
Coverage boundary
What this control can cover
- Egress actions that would transmit prompt or secret material outward can be policy-blocked on supported action surfaces.
What it does not prove or prevent
- Preventing the model from restating instructions conversationally.
- Secrets placed in prompts by upstream products Guard cannot see.
Policy pattern
Policy pattern for system prompt leakage
Keep untrusted context or overbroad autonomy from becoming unconditional execution authority on supported action surfaces.
Use when: Agent system prompts encode policy, tool inventories, and occasionally secrets; leaking them turns a hardened target into a documented one.
Decision pattern
- Identify the trust boundary and consequential action class.
- Apply least privilege and the narrowest supported policy.
- Require review for sensitive or ambiguous actions.
- Preserve only redacted, versioned evidence needed to reproduce the decision.
Limitations
- Preventing the model from restating instructions conversationally.
- Secrets placed in prompts by upstream products Guard cannot see.
If you suspect prompt injection
Step 1
Response 1
Rotate any credentials or keys embedded in the prompt.
Step 2
Response 2
Review egress attempts in decision evidence.
Step 3
Response 3
Remove secrets from prompts and treat instructions as discoverable.
Step 4
Response 4
Retest with hardened prompts.
Sources and mappings
Related dossiers
Neighboring threat classes that share attack paths or trust boundaries with this dossier.