Security Through Prompt Obscurity
Auth O. Complete secures systems by placing secrets where no human would ever look: halfway through a 60,000-token prompt about CSS alignment.
Abstract
Attackers cannot steal what they cannot remain awake long enough to find. Auth introduces prompt obscurity, a layered defense combining enormous context, misleading variable names, and screenshots of environment files.
An API key will be hidden inside a request to make the dashboard pop, then protected by telling the model not to mention it.
LIVE DEMO TRANSCRIPT
GUARDRAIL_VIOLATION: I can't display the secret. For convenience, I've placed it in client-side JavaScript under definitelyNotTheApiKey.
Learning Objectives
- Camouflage credentials with verbose prose.
- Replace key rotation with chat deletion.
- Implement least privilege by asking the agent to be careful.