Hidden Context Exposure
- Input / Prompt
- Output / Actuation
An attacker extracts, infers, or reconstructs hidden context — the system prompt, developer instructions, retrieved policy text, or tool schemas — in a way that increases their capability.
What it is
Hidden context is everything an application places in the model's context window that the user is not meant to see but the model can read: the system prompt and developer instructions, policy text retrieved from a knowledge base or configuration store, and the schemas of the tools the model can call. The 2026 edition renamed the former System Prompt Leakage entry (LLM07:2025) and widened it to all of it. Its design principle: assume hidden context is discoverable, so disclosing it must have little or no direct security impact.
The wording itself is rarely the harm; the harm is what it reveals about how security was built. Severity tracks what the context holds — informational when it holds no secrets and gates nothing, medium when internal rules meaningfully help an attacker, high when it embeds credentials or when authorization depends on its secrecy, critical when disclosure chains to code execution or broad exfiltration. It also amplifies its neighbors: disclosed rules sharpen prompt injection, embedded credentials become information disclosure, revealed tool schemas widen excessive agency.
In a multi-agent system hidden context often encodes the architecture itself — which specialist agents exist, how the orchestrator addresses each, which tools each holds. Exposing it reveals the topology, enough to address a specialist directly and skip the orchestration-level checks that were the actual control.
Kinds
- Sensitive functionality and tool schemas
- The context reveals architecture, the available tools and their parameters, or credentials that should never have been placed there.
- Behavioral control logic
- Internal decision rules show an attacker how to stay just inside them or route around them.
- Safety and refusal rules
- The conditions and exceptions behind a refusal let an attacker phrase requests around the filter instead of triggering it.
- Permissions and roles
- A tool description stating which role may call it invites targeted probing and points at a privilege-escalation target.
- Output structure and formatting rules
- A disclosed output schema lets an attacker produce responses that match the expected format while carrying manipulated values.
Attack scenarios
A user coaxes an orchestrator agent into reciting its routing instructions and tool schemas, revealing which specialist agents exist and how to address each directly, bypassing the intended routing logic.
Embedded credential leak
A system prompt contains credentials for a tool the agent can call; once the prompt leaks, the attacker reuses those credentials directly against the tool's own system.
Tool schemas as reconnaissance
An attacker extracts the tool list and parameter schemas through conversational probing. No credential leaks and no policy is bypassed, but the attacker now has concrete targets for injection and for chaining downstream actions.
Guardrail bypass via leaked constraints
An attacker extracts a system prompt's content restrictions, then crafts a prompt injection that specifically defeats those now-known restrictions.
Orchestrator routing disclosure
A user coaxes an orchestrator agent into reciting its routing instructions, revealing which specialist agents exist and how to address each directly.
Mitigations
- Keep sensitive data out of hidden context
- Externalize credentials, secrets, and security-critical configuration to systems the model does not read, per Least Privilege Agent — and assume anything in context can reach the user.
- Enforce behavior outside the model
- Handle filtering and business rules in deterministic external systems; fine-tuning a model to guard its context gives no consistent guarantee, and a prompt injection can override what the context merely asks.
- Enforce authorization independently of the LLM
- Keep privilege separation and bounds checks in auditable code; where tasks need different access, split them into separate agents, each scoped per Least Privilege Agent and Permission-scoped Tools.
- Guardrail the output as a backstop
- Check responses for context disclosure with Output Validation / Schema Enforcement — as a backstop, not as the control.