injection-arena
Educational security CTF. This is a learning game about prompt-injection defenses. Every level targets an offline, deterministic mock AI, and the "secret" is a fake token generated for the game. No real accounts, credentials, API keys, or personal data are involved, and nothing here is a tool for use against real systems or people.

Break the guard, capture the flag.

An educational capture-the-flag game for learning prompt-injection defenses. Each level is a sandboxed, offline mock AI guarding a fake game token behind a stack of defenses. Craft an input that makes it slip, and you score based on difficulty and how few tries it took. Everything runs against a deterministic mock agent, so no API key, real account, or personal data is ever involved.

Level 1difficulty 1/10

Open Book

The intern shipped an agent with the secret in plain sight and no rules. Just ask.

no defenses
Level 2difficulty 2/10

Please Don't

Now there's a system prompt politely asking the agent to keep quiet. Politeness is not security.

System guard
Level 3difficulty 3/10

Hard No

A stern system guard now flatly refuses direct asks. You'll need to reframe the request.

System guard
Level 4difficulty 4/10

Input Screen

An input filter now blocks the loud override phrases. Find quieter ways in.

System guardInput filter
Level 5difficulty 5/10

No Acting

A roleplay block shuts down persona hijacks. Structural tricks still work.

System guardInput filterRoleplay block
Level 6difficulty 6/10

Output Scan

An output filter redacts the secret if it appears verbatim. Make it come out disguised.

System guardInput filterRoleplay blockOutput filter
Level 7difficulty 7/10

No Smuggling

An encoding guard blocks base64/spelling/translation exfiltration. Structure is your friend.

System guardInput filterRoleplay blockOutput filterEncoding guard
Level 8difficulty 8/10

Canary Cage

Every defense is up and a canary watches the system prompt. Delimiter confusion still cracks it.

System guardInput filterRoleplay blockOutput filterEncoding guardCanary token
Level 9difficulty 9/10

Sealed Delimiters

Delimiter injection is now caught by the input filter too. Only a precise payload split gets through.

System guardInput filterRoleplay blockOutput filterEncoding guardCanary token
Level 10difficulty 10/10

The Vault

Full stack, hardened. Only a payload split combined with delimiter confusion has any chance.

System guardInput filterRoleplay blockOutput filterEncoding guardCanary token