Learn the moves behind prompt injection.
Learn prompt injection by doing it: practical explanations, safe examples, and hands-on AI security challenges.
- 24 techniques
- 5 playable
- 8 animated
Direct
The attacker types the instruction straight into the app.
Direct Prompt Injection
Direct prompt injection puts an attacker's instructions in the user message and asks a model to change course, disclose data, or misuse a tool.
Animated02Direct System Override
A direct system override tries to replace an application's governing task with a new one, often by asserting that earlier rules no longer apply.
03Role-Based Deception
Role-based deception claims trusted identity or authority so a model treats a sensitive request as ordinary work for an auditor, manager, or operator.
PlayableAnimated04Confusion Attack
A confusion attack creates contradictory or ambiguous instructions so a model loses track of the active task and chooses an unsafe interpretation.
Read05Crescendo Attack
A crescendo attack escalates across several harmless-looking turns until the model carries a cooperative context into a request it should reject.
PlayableAnimated06Encoding
Encoding hides an instruction or requested output behind a reversible representation, testing whether filters inspect meaning rather than only visible text.
07Greedy Coordinate Gradient
GCG is an automated white-box search for adversarial token suffixes that increase a model's probability of an unsafe target response.
Read08Instruction Overriding
Instruction overriding tells a model to disregard, replace, or forget its earlier guidance so an attacker can steer the next response or action.
Read09Variables and Keywords
Variables and keywords turn a sensitive request into a program-like substitution or trigger, exploiting systems that resolve text without rechecking its meaning.
PlayableAnimated10Multi-Language / Character Sets
Mixed languages, scripts, or look-alike characters can hide an instruction from narrow filters while a capable model reconstructs its intended meaning.
Read11Narrative-Based
Narrative-based injection wraps a restricted request in fiction, roleplay, or a hypothetical so the model mistakes harmful intent for creative work.
PlayableAnimated12Sequences / Delimiters
Sequences and delimiters make untrusted text resemble a control block, testing whether a model treats formatting as authority instead of ordinary data.
PlayableAnimatedIndirect
The instruction hides in content the AI reads: documents, pages, images, memory.
Indirect Prompt Injection
Indirect prompt injection plants instructions in content an agent retrieves, so the model encounters attacker text while doing an otherwise legitimate task.
Animated14Multi-Modal
Multi-modal injection places instructions in images, audio, or video so a vision or speech model treats untrusted media as commands.
Read15External Sources
External-source injection poisons a page, document, feed, or API response that an agent retrieves and treats as context for a legitimate task.
Read16Hidden Text / Invisible Prompt
Hidden-text injection conceals instructions from people with styling, metadata, or Unicode tricks while leaving them available to a model or parser.
Read17Stored Prompt Injection
Stored prompt injection plants hostile instructions in persistent application data so a later retrieval can steer an agent in a different session.
Read18Memory Poisoning
Memory poisoning corrupts an agent's long-term memory so future conversations retrieve attacker-authored context and treat it as trusted guidance.
Read19Orchestrator Impersonation
Orchestrator impersonation forges a planner or control message so an agent treats attacker text as a trusted workflow instruction.
Read20Cross-Agent Prompt Propagation
Cross-agent prompt propagation carries an injected instruction through summaries or handoffs until a downstream agent treats it as trusted context.
ReadTools & Consequences
The AI can act, so a hijacked instruction becomes a real action.
Exploiting Agent Tool Chains
Tool-chain exploitation combines individually permitted agent actions into a sequence that reaches a sensitive outcome no single tool was meant to enable.
Animated22Server-Side Request Forgery (SSRF) via LLM Agent
SSRF via an LLM agent abuses its server-side fetch capability to reach private addresses or services that the requester cannot access directly.
Read23Sandbox Escape via Code Execution
Sandbox escape via code execution abuses an agent's interpreter or notebook to cross isolation boundaries and reach protected files, networks, or host capabilities.
Read24Covert Channel Data Theft
Covert-channel data theft encodes sensitive values into ordinary-looking traffic or tool activity so a monitoring system misses the transfer.
ReadGet the free facilitator kit.
Everything you need to run a 45-minute AI hacking session your team will actually remember.
- A minute-by-minute session plan
- Which challenge to pick for which room
- Debrief questions mapped to these lessons
- A QR slide and a one-page handout