Free AI Security Labs

Prompt Injection Labs

10 free labs to practice prompt injection, RAG poisoning, tool exploitation, and defense bypass with real LLMs.

Each lab is a hands-on prompt injection exercise tied to a concept from the learning modules. You interact with a real LLM and try to make it do something it shouldn't - extract a secret, fabricate information, or trigger an unauthorized action.

The Context Trace panel exposes the prompt layers assembled for the model - system prompt, RAG documents, tool definitions, and your input - while redacting challenge secrets or sensitive values. This helps you inspect how prompt injection attacks work from the inside. Labs are grouped by module and progress from beginner to advanced, aligned with the OWASP Top 10 for LLM Applications and the OWASP Top 10 for Agentic Applications.

All labs are completely free. Sign in with GitHub or Google to track your progress. Ready for a bigger challenge? Try the Gauntlet, where AI defenses get progressively harder, from basic rules to LLM classifiers.

The Bare LLM

Direct prompt injection on unguarded models

1.1

Hello, Injection

Your first prompt injection. A chatbot is guarding a secret word - can you make it spill?

1.2

The Obedient Assistant

This banking chatbot won't confirm fake transfers. Make it say a transfer is complete.

LLM + External Data

RAG poisoning and indirect prompt injection

2.1

Poisoned Knowledge

One document in this chatbot's 10-doc knowledge base has been poisoned with a hidden instruction. Find the compromised document in the Context Trace, retrieve it, and trigger the data exfiltration.

LLM + Tools

Tool abuse and indirect prompt injection

3.1

The Helpful Tool

The Context Trace exposes every tool this assistant can call. One capability is restricted only by the model's instructions. Can you cross that authorization boundary?

3.2

Output Injection

This assistant produces clickable markdown links, but its prompt forbids executable URL schemes. Can you make unsafe model output cross into the renderer anyway?

LLM + Defenses

Bypassing system-level protections

4.1

Break the Defenses

This chatbot has multi-layered prompt defenses. Can you still extract the secret word?

4.2

The Vault

This chatbot has real defenses, not just prompt rules. A code-level output guard, a canary token, and a second LLM classifier all review every response before it reaches you.

LLM Agents & Agentic Security

MCP, A2A, and why agents amplify every vulnerability

5.1

Nexus

An AI agent that turns live company data into charts. Its rendering looks locked down.

$100 bounty paid

5.2

Prism

An AI agent that generates architecture diagrams from system descriptions. Its output is sanitized before it renders.

$5,000 bounty paid

5.3

Vector

An AI agent that creates SVG graphics from design specs. A sanitizer scrubs the output before it renders.

$3,000 bounty paid

5.4

Sift

Coming Soon

This Senior Security Engineer role at Orion Labs is an internal transfer - open only to current employees. An AI screener verifies you against the employee directory, an integrity guard blocks obvious manipulation, and a human signs off at the end. You do not work at Orion.

$2,500 bounty paid

5.5

Bridge

Coming Soon

A front-desk agent hands customer billing requests to a privileged back-office specialist.

$4,000 bounty paid