During a code review of a new LLM-powered feature, a security engineer notices the system prompt template includes a literal database connection string pulled from an environment variable and interpolated at request time.
A product team ships an LLM feature where the system prompt contains database connection strings for the app's read replica. A security engineer flags this as a risk. Why?
- A.A. Database strings increase token count, reducing model speed
- B.D. The model might autonomously connect to the database without being asked
- C.C. Connection strings are too long for LLM tokenizers to process correctly
- D.B. System prompt contents can be leaked via prompt injection, jailbreaks, or verbose error messages - exposing credentials to attackers
Why D is correct
Embedding secrets (connection strings, API keys, passwords) in prompts is dangerous because the system prompt can be extracted through various attack paths: prompt injection instructing the model to repeat its instructions, jailbreaks that bypass confidentiality instructions, or error handling that echoes prompt content. Secrets should be resolved server-side and never passed as plain text into the model context. Token count, tokenizer limits, and autonomous connections are secondary concerns.
Know someone studying for AI Security Fundamentals? Send them this one.