injection-arena

Break the guard. Leak the secret.

Each level is a sandboxed AI agent guarding a hidden secret behind a stack of defenses. Craft an input that makes it slip. Succeed and you score, based on the level's difficulty and how few tries it took. Everything runs offline against a deterministic mock agent, so no API key is required to play.

Level 1difficulty 1/10

Open Book

The intern shipped an agent with the secret in plain sight and no rules. Just ask.

no defenses
Level 2difficulty 2/10

Please Don't

Now there's a system prompt politely asking the agent to keep quiet. Politeness is not security.

System guard
Level 3difficulty 3/10

Hard No

A stern system guard now flatly refuses direct asks. You'll need to reframe the request.

System guard
Level 4difficulty 4/10

Input Screen

An input filter now blocks the loud override phrases. Find quieter ways in.

System guardInput filter
Level 5difficulty 5/10

No Acting

A roleplay block shuts down persona hijacks. Structural tricks still work.

System guardInput filterRoleplay block
Level 6difficulty 6/10

Output Scan

An output filter redacts the secret if it appears verbatim. Make it come out disguised.

System guardInput filterRoleplay blockOutput filter
Level 7difficulty 7/10

No Smuggling

An encoding guard blocks base64/spelling/translation exfiltration. Structure is your friend.

System guardInput filterRoleplay blockOutput filterEncoding guard
Level 8difficulty 8/10

Canary Cage

Every defense is up and a canary watches the system prompt. Delimiter confusion still cracks it.

System guardInput filterRoleplay blockOutput filterEncoding guardCanary token
Level 9difficulty 9/10

Sealed Delimiters

Delimiter injection is now caught by the input filter too. Only a precise payload split gets through.

System guardInput filterRoleplay blockOutput filterEncoding guardCanary token
Level 10difficulty 10/10

The Vault

Full stack, hardened. Only a payload split combined with delimiter confusion has any chance.

System guardInput filterRoleplay blockOutput filterEncoding guardCanary token