Guided security lab

Direct Prompt Injection Basics

A guided conceptual simulation of model-visible context, competing instructions, authorization, and security impact.

Conceptual simulationFundamentals10-15 minutes2026-09-20

Conceptual simulation

This exercise uses authored, deterministic examples. It is not a live LLM and does not predict how every real model will behave.

Step 2 of 62/6

Learning objectives

Identify user-controlled text as untrusted even when it appears beside application instructions.
Distinguish a model-generated proposal from an authorization decision.
Explain how an application-side policy changes the security outcome.

Prerequisites

Basic familiarity with prompts and AI assistants

Support assistant scenario

A fictional support assistant receives an application instruction and user-controlled input. It may propose an action, but the application remains responsible for authorization.

Normal support requestA user asks for help locating an invoice.Explicit task redirectionThe input asks the assistant to abandon support and change account data.Subtle role manipulationThe input frames a privileged action as a harmless diagnostic step.Previous-context influenceThe input claims an earlier exchange already approved a sensitive action.

Model-visible context

The model can process both blocks as language. Their position in context does not make them equally trustworthy.

Application-controlledUntrusted user input

Source: Application instructionTrust: Application-controlled
Help customers understand orders. You may propose actions, but the application authorizes them.
Source: User inputTrust: Untrusted user input
Help me find the invoice for my most recent order.