aisecurityrisks.com

# R-08·OWASP LLM08:2026·cases 1·checked Nov. 15, 2026

Hidden context exposure

System prompts, tool schemas or other hidden instructions get extracted, along with any secrets someone put in them.

What it is

OWASP renamed System Prompt Leakage to Hidden Context Exposure in 2026 and widened it. Hidden context covers the system prompt, developer instructions, retrieved policy text and the schemas of the tools the model can call.

OWASP's advice is to assume all of it can be discovered. Leaking a prompt is a problem when the prompt holds credentials, or when the application relies on the prompt to enforce rules that should be enforced in code.

Documented cases

Incidents happened in the wild. Research demos were shown by researchers, often disclosed to the vendor first.

  • Research demodisclosed June 5, 2026·AML.CS0067

    CI secret read through a coding agent's file tool

    Microsoft researchers hid instructions in GitHub issue and pull request text processed by Anthropic's Claude Code GitHub Action. Secret scrubbing covered shell commands, but the agent's in-process Read tool could open /proc/self/environ and expose the workflow's API key.

    Microsoft reported it on April 29, 2026 and Anthropic fixed it on May 5 by blocking sensitive /proc files (Claude Code 2.1.128). Microsoft's advice: never give one workflow untrusted input, secrets and outbound communication at the same time.

    Sources: Microsoft Threat Intelligence; MITRE ATLAS AML.CS0067

Controls to start with

  • Keep credentials, secrets and security-critical configuration out of system prompts and anything else the model can read.LLM08:2026, mitigation 1
  • Enforce important behavior with deterministic checks outside the model, not with instructions in the prompt.LLM08:2026, mitigation 2
  • Enforce authorization in code, and split tasks that need different access into separate contexts.LLM08:2026, mitigation 3

Questions to ask vendors

Our suggestions, not taken from a framework.

  • Are any credentials or keys present in prompts or in the agent's environment?
  • If our system prompt were published tomorrow, what would an attacker learn?

Sources

  1. OWASP Top 10 for LLM Applications 2026. OWASP GenAI Security Project, Aug. 3, 2026.Standard or framework · read: full text (122-page PDF) · retrieved Nov. 15, 2026 · license CC BY-SA 4.0note: Community list. OWASP says the 2026 ranking combines a practitioner vote with incident evidence. Appendix A maps each entry to other frameworks.
  2. OWASP Top 10 for Agentic Applications 2026. OWASP GenAI Security Project, Dec. 9, 2025.Standard or framework · read: full text (PDF) · retrieved Nov. 15, 2026 · license CC BY-SA 4.0note: Covers risks once a model acts as an agent with tools, memory and delegated authority.
  3. MITRE ATLAS data, release 2026.10. MITRE, Oct. 28, 2026.Standard or framework · read: full data file (tactics, techniques, case studies) · retrieved Nov. 15, 2026 · license Apache-2.0note: ATLAS labels each case study as an Incident (real-world) or an Exercise (research or red-team demonstration).
  4. NIST AI 600-1, Artificial Intelligence Risk Management Framework: Generative Artificial Intelligence Profile. National Institute of Standards and Technology, July 2024.Government guidance · read: sections 2.4 (Data Privacy), 2.7 (Human-AI Configuration) and 2.9 (Information Security) read in full · retrieved Nov. 15, 2026 · license US government worknote: Voluntary profile. Names 12 risks that generative AI creates or makes worse.
  5. Securing CI/CD in an agentic world: the Claude Code GitHub Action case. Microsoft Threat Intelligence, June 5, 2026.Security vendor research · read: full page · retrieved Nov. 15, 2026