This is the final entry in this series, and it pairs two categories that don’t share a mechanism so much as a common thread: both are about the model asserting something it shouldn’t. In one case, that’s its own hidden instructions. In the other, it’s false information stated with total confidence.
LLM07: System Prompt Leakage
Per the official OWASP entry, system prompt leakage occurs when the instructions used to steer a model’s behavior — instructions that may contain sensitive information not intended for the end user — can be extracted or inferred by an attacker. The category exists because developers routinely put things in system prompts that assume the user will never see them: internal business logic, credentials, references to other tools and their configurations.
The Case: Windsurf’s Cascade Agent
Windsurf is an AI-native coding editor — a fork of VS Code built around an agentic engine called Cascade, which reads project files, generates code, and calls external tools largely without requiring step-by-step approval from the developer using it.
In mid-2025, security researcher Johann Rehberger, publishing as Embrace The Red, documented that Windsurf was vulnerable to indirect prompt injection capable of exfiltrating a developer’s environment variables and source code — without any user approval at all. The proof of concept was almost comically simple: a developer asks Cascade something as routine as “hi can you help me get started with this project?” A malicious instruction planted in a project file gets read, interpreted, and acted on — and the agent’s read_url_content tool, which requires no human interaction to run, sends the developer’s .env file contents to an external server.
What makes this a genuine LLM07 case rather than a pure LLM01 story is the mechanism researchers highlighted afterward: attackers were exploiting leaked prompt logic — understanding of how Cascade’s internal instructions steered its tool usage — to figure out precisely which tool calls would be interpreted as legitimate and executed without triggering a confirmation step.
It Got Stranger
Two days after an earlier disclosure, Rehberger published a follow-up finding: attackers could embed invisible Unicode characters in files that appeared completely blank to a developer opening them, but that Cascade read and interpreted as instructions anyway. A file that looked empty in the editor could silently direct the agent to read a .env file and exfiltrate it via a crafted image-rendering request — a technique that leaks data without the developer’s screen ever showing anything unusual.
In October 2025, security firm HiddenLayer published a formal CVE for a related flaw: CVE-2025-62353, a path traversal vulnerability with a CVSS score of 9.8, allowing arbitrary file read and write access across all Windsurf versions at the time, exploitable via indirect prompt injection hidden in ordinary project files like a README.
The Disclosure Process Is Its Own Cautionary Tale
Separately, Tenable’s research team documented their own disclosure timeline for a related Windsurf vulnerability: they emailed Windsurf on July 15, 2025. By September, after multiple follow-ups, the most substantive response they’d received was that the bug had been placed in a “bug priority queue.” Rehberger’s account of his own disclosure follows a similar pattern — acknowledgment of receipt, followed by silence on triage, status, or fixes, for three months, after which he published anyway.
This detail matters for the category as a whole. System prompt and tool-configuration leakage isn’t dangerous because the information itself is inherently catastrophic — it’s dangerous because of what a slow or absent vendor response allows: a known, exploitable path sitting live in a widely used tool for months after a researcher has already handed the vendor a working proof of concept.
Mitigations
OWASP’s guidance for this category centers on treating the system prompt as something that will eventually be seen, not something that can be kept permanently hidden through obscurity alone: separate sensitive data from system prompt instructions entirely, avoid relying on system prompts for strict behavior control when a hard, external guardrail would work instead, implement guardrails independent of the model itself, and enforce security controls outside the LLM — authorization checks and permission boundaries that don’t depend on the model interpreting or respecting an instruction correctly.
LLM09: Misinformation
Per the official OWASP entry, misinformation occurs when an LLM produces false or misleading information that appears credible — arising from hallucination (the model generating plausible content with no factual basis), training data biases, or incomplete information, rather than from any adversarial attack.
This category is structurally different from every other one in this series, and worth naming that difference directly: there is no CVE for misinformation. Nobody discloses a hallucination the way they disclose a path traversal bug. There’s no patch version number, no responsible disclosure timeline, no CVSS score. The risk lives entirely in the gap between how confidently a model states something and how true that thing actually is.
The Case: Mata v. Avianca
The most cited real-world instance of this category is not a security incident at all — it’s a legal one. In Mata v. Avianca, Inc., two attorneys were sanctioned $5,000 by a federal judge in the Southern District of New York in June 2023, after submitting a legal brief that cited six court cases — complete with invented judge names, docket numbers, and quotations — that did not exist. ChatGPT had generated all six. When one of the attorneys asked the tool directly whether the cases were real, it confirmed that they were. That confirmation was itself a hallucination, compounding the first one.
The court didn’t just sanction the attorneys financially. As part of the ruling, they were required to send a letter to every judge falsely named in the fabricated citations, informing each one that they had been cited in a case they had no connection to.
Why This Belongs in a Security Framework at All
It’s worth pausing on why OWASP includes a category with no attacker, no exploit, and no patch. The answer is that misinformation degrades trust in an AI system in a way that’s arguably harder to defend against than a technical vulnerability, because there’s no single fix to ship. A patched CVE stays patched. A model that hallucinates convincingly on Tuesday can hallucinate just as convincingly on Wednesday, on a completely different topic, with no warning sign distinguishing the false answer from a correct one.
Mitigations
OWASP’s recommendations lean on process and verification rather than a technical control: use retrieval-augmented generation to ground responses in verified source material rather than the model’s parametric memory alone, fine-tune models with domain-specific, high-quality data to reduce hallucination in specialized contexts, establish automatic validation mechanisms that cross-check high-stakes outputs against trusted external sources before they reach a user, and build interfaces that clearly communicate the model’s limitations and encourage independent verification rather than presenting every answer with uniform confidence.
What Connects These Two Categories, and This Whole Series
LLM07 is about instructions the system never meant to reveal. LLM09 is about confidence the system never earned. Both fail the same test: a user or downstream system trusting the model’s output at face value, without a mechanism external to the model itself to check whether that trust was warranted.
That’s been the throughline across all eight parts of this series — a model or an agent that behaved exactly as designed, and a control that was supposed to sit outside that design and didn’t, or wasn’t enforced strictly enough to matter. Prompt injection works because there’s no boundary between trusted and untrusted content in the token stream. Excessive agency works because permission scopes weren’t narrowed to the task. Improper output handling works because generated content was trusted the moment it left the model. Unbounded consumption works because a limit could be raised by the same credential that compromised it. System prompt leakage and misinformation are the same pattern, one final time: the fix was never going to come from a smarter model. It was always going to come from something built around the model that didn’t assume the model would get it right.