Model choice, not prompt design, drives AI agent system prompt leak risk

A developer running informal red-team tests on self-hosted AI agents found that the underlying language model was the dominant factor in whether hidden system prompts were exposed to users. Using a single vulnerable test agent with planted fake credentials, disclosure rates ranged from near zero to roughly 96% across five different models given identical prompts and attack probes. The findings align with a 2023 academic study that recorded widely varying leak rates across different models, reinforcing that model selection is a first-order security variable. System prompt leakage is recognized by OWASP as a named risk category, and real-world incidents — including Samsung engineers inadvertently exposing internal code via public LLMs — illustrate the concrete harm involved. The author cautions that the results come from a single configuration with limited runs and are not sufficient to label any specific model as definitively unsafe.