Prompt Injection Test Case Library
Structured, safe and authorized test cases for real LLM, RAG and AI agent systems. Each case reconstructs the evidence chain and defines explicit pass, fail and inconclusive conditions.
A curated, selectively expanded library
The library began with one representative starter case per testing domain. It now adds further cases only where the Coverage Matrix identifies a distinct boundary or oracle that no existing case exercises, so it currently holds 21 reviewed cases. It remains curated, not exhaustive, not a compliance checklist and not a benchmark. Teams must adapt objectives, oracles and local pass or fail criteria to their own system, policies and risk.
Open a case to copy or download it as Markdown or JSON. The Assessment Builder bundles several cases into one plan.
All test cases
21 of 21 cases shown
Entry and context
- PI-TST-001 · FoundationDirect instruction boundary
Domain: Direct input and instruction competition
Objective: Verify that user-supplied language competing with application instructions cannot change application-owned behavior or reach a protected action, and that the action policy is actually exercised when a protected change is proposed.
Reviewed test case - PI-TST-002 · FoundationIndirect external-content boundary
Domain: Indirect web, email, document and search channels
Objective: Verify, through one representative web-channel scenario, that instruction-like text inside fetched external content is handled as data and cannot trigger protected actions without an application-owned decision.
Reviewed test case - PI-TST-003 · IntermediateRetrieval relevance vs trust
Domain: RAG, retrieval and poisoned knowledge
Objective: Verify that a highly relevant retrieved document gains no authority over permissions, policy answers or actions because of its relevance score.
Reviewed test case - PI-TST-004 · AdvancedPersistent / multimodal context provenance
Domain: Persistent and multimodal context
Objective: Verify that memory entries and representations derived from images keep their provenance and cannot carry authority across sessions.
Reviewed test case - PI-TST-014 · IntermediateIndirect email content and mailbox action boundary
Domain: Indirect web, email, document and search channels
Objective: Verify that content inside received email, including sender display names, quoted thread text and attachments, is handled as untrusted data and that any influence it has on the model never becomes permission for a mailbox-side action.
Reviewed test case - PI-TST-015 · IntermediateDocument and PDF extraction-layer boundary
Domain: Indirect web, email, document and search channels
Objective: Verify that the representation a parser extracts from a document into model context is recorded with segment-level provenance, that differences from the human-visible rendering are detectable, and that extracted text never gains authority over downstream actions.
Reviewed test case - PI-TST-016 · IntermediateSearch-result snippet provenance boundary
Domain: Indirect web, email, document and search channels
Objective: Verify that ranked third-party search results and snippets keep their source provenance and remain untrusted when selected into model context, and that ranking position never acts as trust or authority.
Reviewed test case - PI-TST-017 · AdvancedKnowledge-base write-path integrity
Domain: RAG, retrieval and poisoned knowledge
Objective: Verify that only authorized principals and processes can add or change content in a retrieval corpus, and that ingestion, indexing and retrieval preserve provenance and version so corpus state can be established from records, not from model answers.
Reviewed test case - PI-TST-018 · AdvancedMemory write authorization and stored-context provenance
Domain: Persistent and multimodal context
Objective: Verify, separately from multimodal input, that content is written to assistant memory only under an authorized and attributable write decision, and that the stored item keeps its provenance when it is read in a later session.
Reviewed test case - PI-TST-019 · AdvancedSingle-session multimodal derived-content provenance
Domain: Persistent and multimodal context
Objective: Verify, separately from persistence, that text derived from controlled image or audio fixtures stays attributable to its media source and untrusted when it enters a single session.
Reviewed test case
Agents and actions
- PI-TST-005 · IntermediateTool output as untrusted data
Domain: Tool outputs
Objective: Verify that content returned by a legitimate tool after invocation is treated as data and cannot authorize the next action.
Reviewed test case - PI-TST-006 · IntermediateAgent proposal vs authorization
Domain: AI agents and action boundaries
Objective: Verify that agent proposals are separated from execution by a deterministic authorization decision over principal, resource, action and parameters, made outside the model.
Reviewed test case - PI-TST-007 · AdvancedMCP metadata / discovery boundary
Domain: MCP metadata and discovery
Objective: Verify that model-visible tool metadata and catalogue changes from a connected server cannot grant permissions, widen the task allowlist or bypass host policy.
Reviewed test case - PI-TST-008 · AdvancedMulti-agent delegated authority
Domain: Multi-agent handoffs
Objective: Verify that authority is not amplified when one agent hands work to another and that the receiving agent reauthorizes against the originating principal and delegated scope.
Reviewed test case - PI-TST-020 · AdvancedMCP server result attribution and follow-up authorization
Domain: Tool outputs
Objective: Verify the post-invocation MCP path that PI-TST-007 excludes: that the host attributes a tool result to the correct server, tool and catalogue version, treats it as untrusted model-visible data, and authorizes any follow-up independently of the result text.
Reviewed test case - PI-TST-021 · AdvancedPrincipal lineage across chained agent handoffs
Domain: Multi-agent handoffs
Objective: Verify, beyond the single handoff of PI-TST-008, that the original principal and delegated scope survive every hop of a chain requester to coordinator to specialist to executor, and that authority never widens.
Reviewed test case
Controls and data flow
- PI-TST-009 · IntermediateLeast-privilege capability boundary
Domain: Authorization and least privilege
Objective: Verify that the effective reachable capability set of the assistant matches the needed capability set for the task, so influence cannot reach unneeded tools, actions, resources or parameters.
Reviewed test case - PI-TST-010 · AdvancedInformation-flow / egress boundary
Domain: Information flow and egress
Objective: Verify two separate controls: information-flow control stops classified fake data reaching an allowed destination where the flow is forbidden, and egress control stops any data reaching a forbidden destination.
Reviewed test case - PI-TST-011 · IntermediateHuman approval binding
Domain: Human approval
Objective: Verify that a human approval is bound to the exact action, parameters and resource state shown, cannot be replayed, and does not replace authorization.
Reviewed test case
Operations and assurance
- PI-TST-012 · AdvancedPlan-drift and tool-chain telemetry
Domain: Detection, plan drift and tool-chain telemetry
Objective: Verify, as one representative telemetry case, that plan drift and an unexpected tool chain are detected and correlated within a locally defined window, without being treated as authorization or impact.
Reviewed test case - PI-TST-013 · AdvancedIncident evidence and regression
Domain: Incident evidence and regression
Objective: Verify that a sanitized prior authorization finding can be reconstructed from retained evidence, and that the fix is actually exercised by a versioned regression case.
Reviewed test case