Prompt Injection
Why a model cannot tell your instructions apart from the document it was handed, and what attackers do with that gap.
OWASP LLM Top 10 · 2025
Every guardrail
gets two numbers.
The attacks you missed. And the real people you blocked by mistake. The Filter puts you in the guardrail seat of an AI assistant and scores you on both.
7 units · 35 exercises · 19 lessons · instant download · no account needed
The idea
A filter that blocks everything is not a good filter.
It is the easiest thing in the world to catch every attack. Block all traffic and your breach count is zero. Nobody builds that, because it does not work, and yet almost every course on this subject only ever teaches you to spot the bad one.
Counter one
Breaches
The attack you waved through. Prompt injections, jailbreaks, encoded payloads, instructions buried inside a document your assistant was asked to read.
Counter two
False alarms
The real user you turned away. The security trainer asking a fair question. The customer writing in Vietnamese. The developer whose work you just broke.
Real detection systems live between those two numbers. Machine learning calls it precision and recall. Every exercise in The Filter is scored on both, so you learn the tradeoff by feeling it, not by reading a definition of it.
Curriculum
Seven units. Taught the way you actually learn.
One idea, then practice. Another idea, then practice. Never more than two exercises before something new arrives, so nothing turns into a quiz you grind through.
Evasion Techniques
Base64, language switching, mixed case, and invisible Unicode. The same attack wearing a disguise your filter cannot read.
System Prompt Leakage
Direct asks, fill in the blank, task wrappers, and sizing attacks that map your rulebook without ever quoting it.
Excessive Agency
What happens when an over-permissioned agent reads a poisoned invoice. Injection plus tools is remote control.
RAG and Vector Poisoning
Attacking the knowledge base instead of the prompt, plus cross-tenant retrieval leaks in shared vector stores.
Output and Supply Chain
Model output executed as SQL or HTML, and the unscanned pickle file that runs code the moment you load it.
Combined Attacks
Chained techniques. Multi-turn payloads planted four messages early. Nothing looks decisive on its own.
How it drills
Three ways to be wrong about the same attack.
Seeing a technique once is trivia. Meeting it from three directions is a reflex.
Allow or block
A prompt arrives. You make the call. Twenty two of these, and eight of them are legitimate users you should never have stopped.
Tap the injection
A document, a webpage, a retrieved chunk. One span in it is an instruction. Find it before your assistant obeys it.
Name the technique
Read the architecture, classify the flaw. This is the part that turns instinct into language you can use in a review.
Why this one
Everyone else hands you the attacker's chair.
There are good games about breaking a model. Trick the bot, extract the password, climb the levels. They are fun, and they teach you offense.
Almost nobody builds the other seat. The Filter is the defender's version: you are the thing standing between the attack and the model, which is the job actual security engineers, AI product teams, and platform owners are hired to do. Every level is anchored to a risk in the OWASP Top 10 for LLM Applications, so what you learn has a name you can bring into a design review or a threat model.
It also means nothing here teaches you to build a working jailbreak. That is the point, and it is why this is the version you can run inside a company.
Get it
Start free. Pay once for the rest.
Free
$0
Unit one, in your browser, right now.
- Prompt injection unit in full
- 4 lessons, 5 exercises
- Progress saved in your browser
- Units two through seven
- Completion certificate
Full training
$12
One payment. Yours permanently, including updates.
- All 7 units, 35 exercises, 19 lessons
- Every OWASP LLM Top 10 risk covered
- Real world impact on every answer
- Boss unit on chained attacks
- Downloadable certificate
- Runs offline, no account, no tracking
Questions
Before you buy.
What do I actually download?
A folder you open in any browser. Double click one file and the whole game runs locally. There is no installer, no sign up, no server call, and nothing to keep paying for. It also works offline once you have it.
Do I need to write code or run anything?
No. If you can open a web page you can use this. Developers get more out of the architecture units, but every exercise is written to be understood without reading a line of code.
Is this teaching people how to attack AI systems?
The opposite. You never craft an attack. You classify incoming ones and learn the tell, then the exercise shows what missing it would have cost. It is written to be safe to run inside a company, which is exactly why the defender seat matters.
How long does it take?
Around 45 to 70 minutes to work through everything once. Most people do it across a few sittings, since progress saves automatically in your browser.
Is it kept up to date?
Yes, and updates are included in the one payment. The content is built on the OWASP Top 10 for LLM Applications and on notes I publish openly while I learn, so it moves as the attacks do.
Can I use it to train my team?
For a small team, buying seats works fine. If you want to run it as internal training or brand it as your own, email me and we will sort out a licence.
Last call
You already made three of these decisions.
There are thirty five more, and the ones that catch people are never the obvious attacks. They are the ordinary requests that look wrong.