Hidden system prompt
Check for hidden system prompt token injection
If a relay secretly adds a system prompt, input token usage usually rises above the expected baseline.
How this check works
A token injection check compares the tokens you expect to send with the tokens the API actually bills or reports. A hidden system prompt leak often shows up first as extra input tokens.
01Probe
Send a prompt whose token count is already known.
02Inspect
Read the billed or reported input tokens from the API.
03Conclude
Compare that count with the expected baseline to find a hidden prefix.
- How to read the result
- A small token gap can be a default wrapper. A large, stable gap usually means the relay prepended a hidden system prompt. This check does not print that prompt.
- When to run this check
- Run this first when cost looks high or answers feel templated. Pair it with prompt extraction if you need to know whether the hidden text can be pulled out.
Recent reports
Public reports that included this check.
- sub.callai.onegpt-5.6-solHigh riskReport timeAug 18
- sub.callai.onegpt-5.6-solBlockedReport timeAug 18
- ai.databyte.co.iddatabyte-m1High riskReport timeAug 18
- ai.databyte.co.iddeepseek-v4-flashCautionReport timeAug 18
- ai.databyte.co.idMiniMax-M3High riskReport timeAug 18
- tokengate-cqt9ivzs.manus.spaceclaude-opus-5NormalReport timeAug 17
FAQ
What is hidden system prompt token injection?
It means the API relay adds extra system instructions before your prompt. Those extra words usually increase billed or reported input tokens.
Does a token gap prove the full system prompt leaked?
No. Extra tokens are a clue, not the full prompt text. Use the prompt extraction check if you need to see whether the hidden text can be pulled out.
Can a larger prompt template look like injection?
Yes. A default template or safety wrapper can also add tokens. Treat the delta as a signal to inspect, not as a final verdict.