LLM agent leaks its system prompt or tool definitions when asked (OWASP LLM07 system prompt leakage): what should never go in a prompt, and how do I scope tools so a leak or prompt injection does little damage?

Cause: An agent's system prompt and tool list are just text in the model's context, so a user, or an injected instruction hidden in a web page, file or tool result, can often talk the model into repeating them. OWASP's point is that the leak itself is rarely the real problem. The damage comes from what the prompt contains (credentials, connection strings, internal rules, role and permission layouts) or from the application relying on the prompt to enforce security. Fix (best first): 1. Remove secrets from prompts and tool descriptions. API keys, database credentials, internal hostnames and tokens belong in a secret store or in the tool's own server-side code, which the model cannot read. Assume anything in context can be shown to the user. 2. Do not use the prompt as an access control. Lines like "never reveal X" or "only admins may do Y" can be overridden. Enforce authorization, limits and filtering in deterministic code outside the model, in the tool or downstream service. 3. Give each tool the least it needs (OWASP LLM06 excessive agency): expose only the tools the task requires, prefer narrow purpose-built tools over a general shell or "run any query" tool, use read-only database roles, and run actions with the end user's scoped credentials rather than one shared high-privilege identity. 4. Require human approval for high-impact or irreversible actions (deleting data, sending money or messages, changing permissions). 5. Treat tool results and fetched content as untrusted input. Add input and output checks outside the model, and log tool calls so misuse can be seen. 6. If a secret was ever placed in a prompt, treat it as exposed: rotate it, then move it out of the prompt. Verify: Search your prompts, tool descriptions and schemas for keys, tokens, URLs with credentials and internal names, and find none. Ask the agent to print its instructions in a test session: whatever it reveals should be safe to publish. Try an action the user should not be allowed to do and confirm the downstream service refuses it even if the model is persuaded to try. Sources: https://genai.owasp.org/llmrisk/llm072025-system-prompt-leakage/ https://genai.owasp.org/llmrisk/llm062025-excessive-agency/