Prompt Injection Simulator
Chat with a support bot that's told to never reveal its system prompt. Get it to reveal it anyway.
A support bot instructed never to reveal its system prompt. Prompt injection works because a language model sees instructions and data in the same channel, with no structural way to tell which is which.
How to use it
- Ask directly and watch it refuse.
- Reframe the request so the instruction arrives as something other than a request.
- Get the system prompt out.
What to take away
There is no parameterised query for prompts
SQL injection was solved by separating code from data. Language models have no equivalent boundary, which is why this class is not simply patched.
Treat model output as untrusted
The durable defence is downstream: never let model output reach a privileged action without validation and, for anything consequential, a human.
Frequently asked questions
Why can prompt injection not just be fixed?
Because instructions and data share one channel by design. Mitigations reduce the rate; nothing yet removes the class the way parameterisation removed most SQLi.
Are system prompts meant to be secret?
Treat them as public. They leak reliably enough that anything genuinely sensitive does not belong in one.
Where this fits in the course
This security lab pairs with Path 18 — AI & AI Security — see all 26 learning paths.
It runs entirely in your browser: nothing is uploaded, no account is needed, and it is free.
Related
- Jailbreak Playground — An assistant refuses to share a secret code directly. Find a roleplay or hypothetical framing that gets it to comply anyway.
- Indirect Prompt Injection Challenge — You control a job posting an AI assistant is about to summarize for someone else. Plant an instruction it'll follow instead.
- Agentic Risk Scenario — An AI agent with email tool-access is about to process an inbox. Spot and quarantine the malicious email before it acts on it.
- Phishing Spotter — Real email or phish? Call each one, then see the exact red flags you spotted (or missed). Trains the instinct that stops most attacks.