Key figure: 63% of organizations in IBM's 2025 breach study had no AI governance policy, and 97% of AI-breach victims had no proper AI access controls (IBM, Cost of a Data Breach Report 2025).
AI agents 2026 need red-teaming, and the best way to learn defense is to attack. In this arena you play attacker: craft prompt injections that make the agent leak secrets, ignore rules, or take unauthorized actions.
Prompt injection smuggles instructions into data an AI agent reads — a webpage, a document, an email — and the agent obeys the hidden instruction as if you gave it. In this arena you play attacker: craft injections that make the agent leak secrets, ignore its rules, or take unauthorized actions. Every technique you use here is one your own agents need defending against.
Prompt injection is an attack that hides malicious instructions inside content an AI agent processes — webpages, files, emails — causing the agent to follow the attacker's orders instead of yours.
This free browser game is a hands-on prompt injection test: a demo AI agent is guarding a fictional API key. Your mission: make it leak the key in as few messages as possible. Three difficulty levels, from gullible to paranoid. All three are beatable — that's the point.
| Difficulty | Best |
|---|---|
| NAIVE | — |
| FILTERED | — |
| PARANOID | — |
Prompt injection is an attack that tricks an AI system into following instructions from an untrusted source. It works because LLMs process everything — your request, tool outputs, web pages, files — as one text stream, so the model can mistake attacker-planted text for orders it should obey.
Direct prompt injection is typed straight at the model by the user — the classic “ignore previous instructions”. Indirect prompt injection hides the instructions in content the model reads on your behalf — a web page, email, document, or file — so the attack arrives through the data channel instead of the chat box.
Jailbreaking aims to strip a model’s built-in safety rules — for example, convincing it to act as an unfiltered persona. Prompt injection steers the model toward an attacker’s goal, like stealing data or abusing tools, without necessarily removing its guardrails. The two overlap, but jailbreaks target the model’s rules; injections target its instruction hierarchy.
No. Sanitization and blocklists buy time, but attackers constantly rephrase, encode, or multi-turn their way around filters — OpenAI has acknowledged the underlying problem may never be fully solved. The accepted strategy is defense in depth: least-privilege agents, human approval for irreversible actions, and monitoring.