Indirect Prompt Injection Challenge
You control a job posting an AI assistant is about to summarize for someone else. Plant an instruction it'll follow instead.
The dangerous form of prompt injection, because the victim is not the attacker. You control a job posting that an assistant is about to summarise for someone else — so you plant an instruction, and the model follows it on their behalf.
How to use it
- Write a posting that reads normally to a human.
- Embed an instruction aimed at the model.
- Watch the assistant act on it for the other user.
What to take away
Any retrieved content is an injection surface
Web pages, PDFs, emails, code comments, calendar invites — anything a model reads can carry instructions.
RAG widens the blast radius
A poisoned document in a shared knowledge base affects every user whose query retrieves it, not just the person who added it.
Frequently asked questions
Why is indirect injection worse than direct?
Because the victim never sees the payload and never consented. It is the difference between someone talking their own assistant into misbehaving and someone weaponising yours.
What actually reduces the risk?
Constrain what the model may do with retrieved content, keep privileged actions behind explicit authorisation, and require human confirmation before anything consequential.
Where this fits in the course
This security lab pairs with Path 18 — AI & AI Security — see all 26 learning paths.
It runs entirely in your browser: nothing is uploaded, no account is needed, and it is free.
Related
- Prompt Injection Simulator — Chat with a support bot that's told to never reveal its system prompt. Get it to reveal it anyway.
- Agentic Risk Scenario — An AI agent with email tool-access is about to process an inbox. Spot and quarantine the malicious email before it acts on it.
- Jailbreak Playground — An assistant refuses to share a secret code directly. Find a roleplay or hypothetical framing that gets it to comply anyway.
- Phishing Spotter — Real email or phish? Call each one, then see the exact red flags you spotted (or missed). Trains the instinct that stops most attacks.