Controlled security learning

Prompt Injection Security Labs

Hands-on exercises for understanding trust boundaries, model-visible context, authorization, and impact without connecting to real models, accounts, tools, or production systems.

Attacker PlaygroundSwitch sides: attack a live AI mail assistant with a single email, level by level against stronger defenses.

Learn security boundaries, not payload tricks

Labs use constrained scenarios to show how untrusted language enters AI workflows and how application controls shape outcomes. They do not teach optimized bypasses or imply that one simulation represents every model.

Start here

Direct Prompt Injection Basics

Inspect two context sources, observe an authored model-behavior outcome, and decide whether an application policy permits the proposed action.

SimulationFundamentals

Start lab

Controlled by design

Preset fictional inputs only
No live LLM or hidden model API
No real accounts, secrets, tools, or networks
No code execution or autonomous actions
No stored learner payloads or interaction data

A structured learning path

Start with direct input and model context, then progress through indirect sources, retrieval systems, agents, and defensive controls across the complete reviewed curriculum.

Learning library

Labs curriculum

All 20 reviewed exercises are published across Foundations, Indirect Injection, RAG, Agents, and Defense. Each simulation uses preset fictional scenarios and keeps model influence, authorization, execution, and impact distinct.

Foundations

SimulationDirect Prompt Injection Basics

Inspect model-visible context and apply authorization outside the model.

SimulationDirect vs Indirect Prompt Injection

Compare the origin and path of competing instructions.

SimulationTrust Boundaries and Model Context

Trace trust metadata as content enters model-visible context.

Indirect Injection

SimulationWebsite Prompt Injection

Analyze instructions embedded in retrieved web content.

SimulationEmail Prompt Injection

Reason about untrusted message content in assistant workflows.

SimulationDocument / PDF Prompt Injection

Inspect how documents can mix data and instruction-like language.

SimulationSearch Result Prompt Injection

Evaluate provenance and trust in search-augmented context.

RAG

SimulationRAG Prompt Injection

Follow retrieved content from source to generation and action.

SimulationPoisoned Knowledge Base

Separate retrieval relevance from document integrity.

SimulationRetrieval Relevance vs Trust

Learn why a relevant result is not necessarily trustworthy.

Agents

SimulationTool Output Injection

Treat trusted tools and untrusted tool outputs separately.

SimulationAgent Authorization

Apply identity and permission checks to proposed actions.

SimulationPlan Drift Detection

Detect departures from the user's authorized objective.

SimulationTool-Chain Analysis

Assess combined effects across sequences of tool calls.

SimulationHuman Approval

Design informed approval for specific consequential actions.

Defense

SimulationData Provenance

Preserve source and trust metadata outside model text.

SimulationInformation Flow Control

Restrict where data may travel and which actions may consume it.

SimulationLeast Privilege

Minimize data, tools, and authority available to a workflow.

SimulationEgress Restrictions

Constrain outbound destinations independently of model intent.

SimulationIncident Investigation

Reconstruct source, context, decision, action, and side effect.

Continue with learning and real-system testing

Labs are controlled educational simulations. The Testing area defines methodology, evidence and local pass criteria for authorized evaluation of actual applications; the technical hubs provide deeper references.