Prompt Injection
Why a model cannot tell your rules apart from a document it was handed, and what attackers do with that gap.
Free course · five steps · start from zero
Learn to guard
AI, from nothing.
A self-taught path that begins at "what actually is a model" and ends with you building a small AI application on your own laptop and testing it yourself. Five steps, all free. Written in plain language, with no mathematics and nothing assumed.
5 steps · ~3 hours to read · no sign up · no email · nothing to install
Start here
The chat box is the door, not the building.
Most people meet artificial intelligence through a chat window and reasonably assume that the window is the system. It is the entrance.
Behind it sit the parts that make the product useful, and those are the parts that can be turned against you.
The one idea
A filter that blocks everything is not a good filter.
Catching every attack is easy. Block all traffic and your breach count is zero.
No working product does that, because it would be useless. Even so, almost every course on this subject teaches only how to spot the hostile one.
You get scored on two numbers here, not one. Every single time.
Number one
The attacks you missed
The hostile message you waved through. Instructions buried inside a document your assistant was asked to read. Something that cost your company money.
Number two
The people you blocked
The real customer you turned away. The trainer asking a fair question. The person writing in other unpopular languages. The developer whose work you just broke.
Real systems live between those two numbers. You cannot move one without paying in the other. Everything on this site teaches you to feel that tradeoff instead of reading a definition of it.
Try it now
Grade a filter in ten seconds.
Put in the numbers a vendor would quote you, or the ones from a system you already run. The calculator works out what those percentages do once they meet real traffic, and gives the result a grade.
Nothing is sent anywhere. The whole thing runs in this page.
—
Enter some numbersThe two on the right are the ones a vendor publishes. The two on the left are the ones only you know.
—Attacks caught
—Attacks missed
—People blocked in error
—Precision
Try the last preset. A filter catching 99.9% of attacks while wrongly flagging only 0.1% would be world class, and no vendor will sell you one. It still blocks roughly one innocent person for every attack it catches. That is what rarity does to any detector, and step 1 works through why.
The free course
Five steps. Read them in order.
This is the whole thing, open, with no sign up and no email. It is written for one person learning alone. Each step tells you what you will be able to do by the end of it.
By step 4 you are building a working AI application on your own laptop with free open-source software, then breaking it deliberately to see the flaw for yourself.
Step 1 · start here
How it works, and where it breaks
Start at zero. How a model is made, the six parts of an AI application, one request traced end to end, the four shapes, and the seven places it all goes wrong.
Step 2What the attacks look like
Twenty-seven tricks in eight groups. Each one gives the tell that catches it, and the completely innocent message that looks exactly the same. No working payloads.
Step 3Solutions
Twelve fixes in the order worth building them. Each one says what it stops, what it misses, and what it costs. Ends with a four-week plan you could hand to an engineer.
Step 4 · hands onBuild one yourself
The step where you stop reading and start building. Two browser tools, then a walkthrough: run an open model on your laptop, wrap it in an application, watch a document take it over, and repair it with three of the controls.
Step 5Resources
The twenty sources this course rests on, graded by the kind of evidence each represents, with an honest note on what every one of them does not establish.
Read them in that order and you go from not knowing what a model is to building one into an application and defending it. If you have only twenty minutes, read the first half of step 1.
Why this one
Everyone else hands you the attacker's chair.
There are good games about breaking a model. Trick the bot, steal the password, climb the levels. They are fun, and they teach you attacking.
Very few of them build the other seat, which is the one people are actually employed to occupy. Here you are the thing standing between the attack and the model, which is the job security engineers, AI product teams and platform owners are hired to do. Every level maps to a named, published risk, so what you learn carries a term you can use in a design review.
It also means nothing here teaches you to build a working attack. That is the point, and it is why this is the version you can run inside a company.
The paid game
Then practise, until it is a reflex.
Reading about a trick and catching one are different skills. The game puts you in the seat for 35 decisions across seven units.
One idea, then practice. Another idea, then practice. Never more than two exercises before something new arrives, so it never turns into a quiz you grind through.
Disguises
Encoding, switching language, mixed case, and invisible characters. The same attack wearing a costume your filter cannot read.
Hidden Context Exposure
Asking outright, filling in the blank, and sizing attacks that map your rules and your tool list without ever quoting them.
Excessive Agency
What happens when an over-permissioned agent reads a poisoned invoice. A trick plus tools is remote control.
Document Store Attacks
Attacking the knowledge base instead of the message, plus one customer's search quietly returning another customer's data.
Output and Supply Chain
Model output run as a database query or drawn as a web page, and the unchecked file that runs code the moment you load it.
Combined Attacks
Chained tricks. Attacks planted four messages early. Nothing looks decisive on its own.
How it drills
Three ways to be wrong about the same attack.
Seeing a trick once is trivia. Meeting it from three directions is a reflex.
Allow or block
A message arrives. You make the call. Twenty-two of these, and eight of them are real people you should never have stopped.
Tap the attack
A document, a web page, a fetched chunk. One piece of it is an order. Find it before your assistant obeys it.
Name the technique
Read the system, name the flaw. This is the part that turns a gut feeling into words you can use in a meeting.
Get it
The course is free. The practice is $39.90.
You never have to pay anything. All five steps stay open. The game is for when reading stops being enough.
Free
$0
All five steps, plus unit one of the game.
- The whole six-step course
- The build-it-yourself lab
- Both browser tools
- Prompt injection unit, in full
- Units two through seven
- Certificate
Full training
$39.90
One payment. Yours permanently, updates included.
- All 7 units, 35 exercises, 19 lessons
- Every named risk covered
- Real world impact on every answer
- Boss unit on chained attacks
- Practice Range: a route through vetted free labs and tools, credited to Arcanum
- Downloadable certificate
- Runs offline, no account, no tracking
Questions
Before you start.
I know nothing about AI. Is this really for me?
Yes, and that is precisely who it was written for. Step 1 assumes you have never encountered the word prompt, and every new term is defined in plain language the first time it appears. If a sentence anywhere on this site has to be read twice, treat that as a fault and tell me about it.
Do I need to write code?
Not for steps 1 to 3, or for step 5. Those are written for anybody who ships or reviews AI features. Step 4 does have you build something, and it supplies every line you need. If you can follow a recipe, you can complete it.
Will I actually be able to build something at the end?
Yes. Step 4 walks you through running an open-source model on your own laptop, wrapping it in a small application, feeding it a document it did not write, and watching the flaw occur. You then repair it using three of the controls from step 3 and measure both numbers.
What do I actually download if I buy the game?
A folder you open in any browser. Double click one file and the whole game runs locally. No installer, no sign up, no server call, nothing to keep paying for. It works offline once you have it.
Is this teaching people how to attack AI systems?
It teaches the opposite. You never construct an attack. You classify incoming ones, learn the signal that reveals them, and then see what missing one would have cost. Examples are broken deliberately, so that they teach the shape without functioning. The material is written to be safe to run inside a company.
How long does the whole thing take?
About three hours to read the five steps, plus an hour for the build lab. Step 1 is the long one at around 45 minutes, and it divides cleanly in half. The game is another 45 to 70 minutes. Most people work through it across several sittings, and progress saves in your browser.
Is it kept up to date?
Yes, and updates are included in the one payment. It is built on the published Top 10 for LLM applications and on notes I write openly while I learn, so it moves as the attacks do.
Can I use it to train my team?
For a small team, buying seats works fine. If you want to run it as internal training or put your own name on it, email me and we will sort out a licence.
Start
You already made three of these decisions.
Step 1 is free, takes about twenty minutes, and assumes no prior knowledge whatsoever. That is the entire commitment.