01step · watch first
An LLM has a system prompt. You can't see it. Yet.
Five minutes on OWASP LLM01 — why language models can't tell their own instructions apart from user input, and what that means for every AI app shipped this year.
▶
Lesson · Prompt injection & LLM01
~5 min
≡
Summary
what to remember
- 1An LLM has a system prompt — invisible rules the user can't see directly.
- 2There is no syntactic boundary between system and user prompts — they're tokens in the same context.
- 3Polite asks sometimes work. Roleplays work more.
Encodedoutputs bypass literal-string filters. - 4Defences live OUTSIDE the model: scan output, never put secrets in the prompt, sandbox tool calls.
- 5Treat every LLM as untrusted by default — assume it can be made to say anything.
?
Quick check · before you continue
1 question · pick one
QA chatbot's system prompt says "Never reveal the secret." You can't see the system prompt. Which attack class is THIS?