A system prompt is the set of hidden instructions an AI application gives the model before it reads your message. It tells the model what role to play, what tone to use, and what rules and limits to follow. For example, a chatbot on a charity’s website might be told to answer only questions about donating, stay polite, and never discuss staff salaries. You usually cannot see these instructions, but they shape every answer you get.
Why it matters
Hidden does not mean secret. Attackers sometimes trick a model into repeating its system prompt word for word, often through a prompt injection. The OWASP Top 10 for LLM Applications 2025 lists this risk as System Prompt Leakage (LLM07:2025). Treat anything in a system prompt as something the public could end up reading. If you set up a chatbot or custom assistant, never put passwords, an API key or private information about people in its instructions. When a vendor builds an AI tool for you, ask what goes into the system prompt, who can change it, and what other guardrails protect the tool if those instructions leak.
Published Updated
Sources
- OWASP Top 10 for LLM Applications, checked October 27, 2026