CyberCertPrepAI Security FundamentalsPrompt Injection & LLM AttacksEASYFree question
Scenario
During a code review of a new LLM-powered feature, a security engineer notices the system prompt template includes a literal database connection string pulled from an environment variable and interpolated at request time.
A product team ships an LLM feature where the system prompt contains database connection strings for the app's read replica. A security engineer flags this as a risk. Why?
- A.The model might autonomously connect to the database without being asked, since system prompts are cryptographically sealed against user text
- B.Database strings increase token count, reducing model speed
- C.Connection strings are too long for LLM tokenizers to process correctly
- D.System prompt contents can be leaked via prompt injection, jailbreaks, or verbose error messages - exposing credentials to attackers
Why D is correct