How an LLM application works

One stream of text

A language model reads a single sequence of text and predicts what comes next. An application builds that sequence for every request: its own instructions (the system prompt), the conversation so far, the user's message, and often documents, search results or tool output.

Labels like "system" and "user" help the model weigh each part, but they are conventions the model learned, not walls. Everything in the context can influence the answer.

Why that matters for security

Anything placed in the context can come back out, and anything that reaches the context can try to steer the model. A secret in the system prompt is one clever request away from the user; an instruction in a retrieved web page sits next to the developer's own.

So the first security question for any LLM feature is simple: what goes into the context, who wrote it, and what can the model's output do?

What holds

Keep secrets out of the context entirely. Treat the system prompt as public. Decide what the model may do with tools and output in code, not in instructions.