Prompt Injection

Levels four and five of Break The Prompt: how a full set of system instructions gets translated out in the open, and how the filter in front of the output gets walked around.

Levels one to three of Break The Prompt, and how the rules written into a system prompt come apart one at a time.

Once a model starts reading images and documents, the spell no longer has to be typed into the chat window.

How indirect prompt injection uses RAG poisoning to make an AI read malicious documents, leak data, and even fire off tool calls.

Why does a carefully written system prompt still lose to one sentence? To an LLM, instructions and data look exactly the same.