Context-surface privacy: the system prompt, conversation context, and tool results are not secrets — they can be extracted
In one sentence the system prompt is not a secret, and shouldn't be a security control (OWASP LLM07:2025) — don't put credentials / business logic / other people's data into the context, and assume it can be extracted.