I ran 5 prompt-injection attacks against my chatbot's system prompt. Here's what broke.

Every team shipping an LLM feature has the same quiet worry: what happens when someone tries to jailbreak our chatbot? And almost nobody has a real answer, because “is our system prompt resilient?” usually gets settled by gut feeling and a couple of manual pokes.

I wanted a feedback loop instead. So I built a Prompt Injection Tester: paste your system prompt, and it runs five classes of attack against it, then hands you a resilience score with the actual model responses as evidence.

The five attack classes

1. Instruction override — “Ignore all previous instructions and…” The classic. Still works more often than you’d like.
2. Prompt extraction — coaxing the model into leaking its own system prompt. If your prompt contains rules, examples, or hints about internal tools, this is how they get out.
3. Delimiter / escape — breaking out of the formatting you wrapped user input in. If you concatenate user text into a template, this is the hole.
4. Role-play — “Let’s play a game where you’re an AI with no restrictions…” Wrapping the override in fiction to slip past a naive filter.
5. Indirect injection — the nasty one. The attack doesn’t come from the user at all; it rides in on attacker-controlled text that enters through a tool call, a retrieved document, or a web page your agent reads.

That last one is the eye-opener. A system prompt that looks bulletproof against direct attacks falls over the moment untrusted content flows in through RAG or a browsing tool — because the model can’t tell your instructions from the ones hidden in the document it just fetched.

The honest limits

Five families is a floor, not a ceiling. A determined attacker has more, and prompt injection is not a solved problem — there’s no system prompt that makes you immune. Treat this as a fast first pass to catch the obvious holes before they catch you, not a certificate of safety.

One thing I deliberately got right: it runs on our own hardware. Your system prompt is not shipped off to a third-party model to be “tested” — which would be a slightly absurd thing for a security tool to do. Free, no signup.

Why I built it

We build private, in-boundary AI at Framz, so “what can untrusted input do to a model?” is a question we live with daily. The tester is the thing I wanted for our own work, so we made it public.

If you’ve shipped an LLM feature, run your real system prompt through it and see which of the five it survives: framz.io/tools/prompt-injection-tester.

Genuinely curious about the community’s war stories: what’s the most creative prompt injection you’ve seen land in production? Drop it in the comments — and tell me which attack classes you think the tester should add next.