> They would have to get their hands on your prompts

Unless you are running a local model, your prompts are almost certainly logged by your inference provider, and would only be a subpoena away?

Leaks, whistleblowers. Some circumstantial evidence will also do if there's enough of it. Like having hallucinated parts of code that do absolutely nothing, and can't be explained as e.g. leftovers from a refactor.