Is it safe to put an API key in an LLM's system prompt if you instruct the model never to reveal it?
Short answer
No. OWASP's LLM07 guidance is that the system prompt should not be considered a secret, nor used as a security control, and that credentials and connection strings should not be embedded in it. Because LLMs can be steered by prompt injection, an instruction like 'never reveal this' is not an enforcement mechanism. Keep secrets in a secrets manager, and enforce authorization and filtering deterministically outside the model.
It is tempting to treat the system prompt like server-side config: invisible to users, therefore safe. This question tests whether you understand that an LLM is not a trust boundary.
What OWASP says
OWASP LLM07:2025 (System Prompt Leakage) states that the system prompt should not be considered a secret, nor used as a security control. Sensitive material such as credentials and connection strings should never be embedded in it. The listed mitigations are to separate sensitive data (API keys, database names, role structures) from the prompt, avoid relying on system prompts to control model behaviour where possible, add independent guardrails outside the LLM, and enforce privilege separation and authorization checks deterministically outside the model.
Why "never reveal this" doesn't work
The model's behaviour is shaped by text, and attackers also supply text. Prompt injection can steer the model into disclosing or ignoring its instructions, so a natural-language prohibition is a request, not an access control. OWASP also points out that the prompt itself being disclosed isn't the main risk: the failures are the exposed secrets, bypassed guardrails, and authorization logic that was delegated to the LLM.
Why the distractors fail
- "Models reliably obey" — nothing guarantees that; injected instructions compete with yours.
- "Hidden from the UI" — hiding is not protection when the model itself can be coaxed to output it.
- "Base64-encoded" — encoding is not encryption, and the model can decode or reproduce it.
What interviewers want
"Assume the prompt can leak." Then: secrets in a vault fetched by backend code, least-privilege tool credentials, and authorization enforced in code, not in prose.
Likely follow-ups
- How would an attacker try to extract a system prompt, and why does 'don't reveal it' fail?
- If the prompt contains no secrets, is prompt leakage still a risk? What does OWASP say the real failures are?
- Where should authorization for an LLM agent's tool calls be enforced instead?