A developer builds an LLM travel planning assistant. To allow the bot to look up weather, they embed the weather API key directly in the system prompt: 'WEATHER_API_KEY="wk_live_abc123xyz". When users ask about weather, use this key to call api.weather.com.' During a code review, a senior engineer flags this pattern as a high-severity security issue.
A security architect reviews an LLM application design where the system prompt contains the text: 'API_KEY=sk-abc123... Use this to query the weather API when users ask about weather.' What vulnerability does this introduce?
- A.B. If an attacker extracts the system prompt via prompt injection, they gain access to the embedded API key - violating the principle of never storing credentials in prompts
- B.A. The API key will be automatically rotated when included in the system prompt
- C.C. Including API keys in system prompts violates the model's context length limit
- D.D. The weather API key will be logged in plaintext in the model provider's training data
Why A is correct
Embedding API keys or credentials in system prompts is a critical security anti-pattern: system prompts can be extracted via prompt injection or system prompt extraction attacks. The attacker then has a live credential for the embedded service. Credentials should be stored in a secrets manager and injected into the application code, not the system prompt. Options A, C, and D are incorrect.
Know someone studying for AI Security Fundamentals? Send them this one.