Sometimes a symmetric secret key that was used to generate the ciphertext is send with a ciphertext. In that case it is wrapped (encrypted) by the public key of the receiver. The sender must trust that this key is of the receiver, otherwise the sender may be encrypting the key with the public key of an adversary.
The secret key is called a session or data key and is usually randomly generated. The receiver uses it's private key to unwrap (decrypt) the data key, which in turn can be used to decrypt the message. This data key usually has a 1:1 relation with the message; it is not used for any other message.
There are however many other ways of establishing session or data keys:
- key agreement
- key agreement with IES
- key derivation using a master key
- key derivation using RSA-KEM
- key derivation from a password
- out of band key establishment
- secret key sharing
Well, you get the point, there are a few options here.
There are actually instances where the secret key was send together with the ciphertext in plain. As this doesn't offer any security you should consider those kind of protocols utterly broken.