Hidden Context Exposure
The unauthorised extraction, inference, or reconstruction of hidden, non-user-facing system instructions and operational context — the 2026 broadening of system-prompt leakage into a general framework for context that should have stayed out of reach.
What it is
Hidden Context Exposure is the unauthorised extraction, inference, or reconstruction of hidden, non-user-facing system instructions or operational context placed in a model's context window. It becomes security-relevant when that hidden context contains or reveals secrets, policy logic, tool schemas, trust boundaries, workflow criteria, or other sensitive implementation details that materially increase attacker capability. This is the 2026 successor to System Prompt Leakage — the same failure, framed more broadly.
Hidden context typically includes the system prompt, developer instructions, retrieved policy text, and the schemas of the tools and functions the application exposes to the model. The common thread: it is not meant to be visible to end users, but it is accessible to the model.
Design under the assumption that hidden context is discoverable and that nothing in it should be treated as a secret. Do not embed credentials, connection strings, or tokens; do not rely on hidden context as a security boundary for authorisation, privilege separation, policy enforcement, or content filtering.
Severity ranges from informational (no secrets, no reliance on confidentiality) through medium (internal rules or workflow logic that aids an attacker) to high (embedded credentials, or reliance on secrecy for authorisation) and critical (where disclosure chains to remote code execution or privilege escalation). Exposure also amplifies adjacent risks: disclosed rules enable targeted prompt injection (LLM01), embedded credentials are sensitive information disclosure (LLM02), revealed tool schemas expand excessive agency (LLM03), and leaked formatting rules facilitate improper output handling (LLM10).
Common examples
- Exposure of sensitive functionality and tool/function schemas: the hidden context reveals architecture, available tools, API keys, or database credentials — the real failure being that secrets were placed there at all.
- Exposure of behavioural control logic: internal decision-making that lets attackers see how the application works and where to bypass it.
- Reverse-engineering of safety and refusal mechanisms: leaked refusal conditions reveal the triggers and exceptions, so attackers craft inputs that avoid known patterns.
- Disclosure of permissions and user roles: tool descriptions that reveal which role may use a tool invite directed probing and further disclosure.
- Exposure of output structure and formatting rules: revealed JSON schemas or templates let an attacker produce conformant output carrying manipulated values that downstream systems mis-parse.
Prevention & mitigation
- Keep sensitive data out of hidden context. Never embed credentials, secrets, or security-critical configuration in system prompts; assume everything in context is available to users, and externalise secrets to systems the model does not directly access.
- Use deterministic guardrails for behaviour control. Do not rely on hidden context to control behaviour; enforce critical behaviours — including harmful-content prevention — through independent, deterministic systems outside the model.
- Enforce authorisation independently of the LLM. Privilege separation and bounds checks must never be delegated to the model; enforce them deterministically and auditably, separating tasks by authorisation context and granting each only the privileges it needs.
Example attack scenarios
- A system prompt contains credentials for a tool the model can use; the prompt is leaked and the attacker reuses those credentials elsewhere.
- An attacker extracts the tool list and parameter schemas through conversational probing and uses them to steer the application toward specific tool calls — no credential disclosed, but concrete targets for follow-on injection.
- An attacker extracts a system prompt that prohibits offensive content, external links, and code execution, then uses the disclosed restrictions to craft an injection that bypasses each one.
References
- OWASP Top 10 for LLM Applications 2026 — LLM08:2026 Hidden Context Exposure: genai.owasp.org
- OWASP LLM07:2025 System Prompt Leakage (predecessor entry)
- OWASP Top 10 for Agentic Applications — agentic amplifications (memory, inter-agent channels)
How Neural Industries helps. We probe what your system prompt and hidden context give away, confirm that no secret or authorisation decision depends on their secrecy, and move real controls into deterministic systems outside the model.
Request an assessment →