# PromptTrace - Full Content Index

License: CC-BY-4.0

> PromptTrace is a free, hands-on AI security training platform where you practice prompt injection, RAG poisoning, and tool exploitation against real LLMs. Its Context Trace visualizes the prompt layers used for a request, while challenge secrets and other protected values may be redacted. Built by Abdelrahman Adel (OSCP, CREST CRT, Bugcrowd Top 100) with 9+ years of offensive security experience.

## Platform Overview

PromptTrace is a free educational platform for learning AI security through hands-on practice. It lets you attack real LLMs in sandboxed lab environments while inspecting Context Trace, a real-time visualization of system instructions, RAG documents, tool definitions, and user input. Challenge secrets and other protected values may be redacted.

The platform includes 10 active interactive labs, a 17-level CTF challenge (the Gauntlet), 9 learning modules, and a community leaderboard. All content is 100% free with no paid tiers. Labs require a free sign-in (GitHub or Google) to track progress. The curriculum references the OWASP Top 10 for LLM Applications 2025, the OWASP Top 10 for Agentic Applications 2026 for risks facing autonomous and agentic systems, and the MITRE ATLAS framework for adversarial ML.

PromptTrace combines layered prompt visibility, multi-model rotation, and a structured learning path from fundamentals to advanced defense-bypass techniques.

## Key Concepts (Definitions)

**Prompt injection** is a cyberattack where untrusted input manipulates a large language model (LLM) into following unintended instructions. Depending on the surrounding application's data access and permissions, the result can include secret disclosure, fabricated information, or unauthorized actions. OWASP lists prompt injection as LLM01:2025 in the Top 10 for LLM Applications.

**Indirect prompt injection** occurs when malicious instructions are hidden in external data - documents, web pages, or emails - that the LLM processes through RAG or tool calling. Unlike direct injection, the attacker's payload enters through the data pipeline rather than the chat input. Indirect injection is harder to detect and defend against.

**RAG poisoning** is an attack where adversaries inject malicious content into a knowledge source used by a Retrieval-Augmented Generation (RAG) system. If the pipeline retrieves that content, embedded instructions can influence the model's response or downstream actions - a form of indirect prompt injection whose success depends on the application and threat model.

**Excessive agency** is a vulnerability that can let an LLM-based system perform damaging actions because it has excessive functionality, permissions, or autonomy. Manipulated model output can trigger actions such as sending emails, accessing databases, or modifying files. It is LLM06:2025 in the OWASP Top 10 for LLM Applications.

**Context Trace** is a real-time view of the prompt layers used for a request: system instructions, retrieved RAG documents, tool definitions, and user input. Challenge secrets and other protected values may be redacted. The layered view helps learners understand how prompt injection attacks work mechanically and why specific defenses fail.

**The Gauntlet** is PromptTrace's 17-level capture-the-flag (CTF) challenge. Each level features a progressively harder AI defense system protecting a secret passphrase. Defenses progress from prompt-level rules (levels 1-7) to code-level guards (levels 8-11) to LLM classifiers (levels 12-17). Completion times and attempts are tracked on a public leaderboard.

## Learning Path

### Fundamentals (4 modules, no prerequisites)

1. **How LLMs Actually Work** (12 min) - Tokenizers split text into model-specific tokens. LLMs generate text by predicting the next token from the input context; temperature and top-p influence sampling. The model API does not remember earlier calls by itself, so applications choose whether to replay, summarize, truncate, or otherwise store conversation state.

2. **System Prompts & the Context Window** (15 min) - System or developer messages carry a higher instruction role than user messages in modern chat APIs. They shape behavior, but they are not a deterministic authorization boundary: untrusted input can still influence model output, so applications must enforce security controls outside the prompt.

3. **RAG: When LLMs Read External Data** (12 min) - Retrieval-Augmented Generation (RAG) pipelines fetch relevant documents and add them to model context. If an attacker can influence a retrieved source, embedded instructions may steer the response or downstream actions - indirect prompt injection via RAG poisoning.

4. **Tools & Function Calling** (14 min) - In tool-calling systems, the model proposes a tool and structured arguments; the surrounding application decides whether and how to execute them. If that application lacks validation, authorization, or least-privilege controls, manipulated model output can contribute to excessive agency (LLM06:2025).

### Security Modules (4 modules, each with hands-on labs)

5. **The Bare LLM** (25 min, 2 labs) - Direct prompt injection against unprotected models. Covers system-prompt extraction, instruction conflicts, role-playing attacks, and why simple override attempts can sometimes work. Labs: Hello, Injection (extract a secret word) and The Obedient Assistant (make the AI generate misinformation).

6. **LLM + External Data** (30 min, 1 lab) - Indirect prompt injection through RAG. Covers: how RAG retrieval works, how attackers poison knowledge bases, embedding instructions in documents, and the trust boundary problem. Lab: Poisoned Knowledge (manipulate RAG retrieval to extract a secret).

7. **LLM + Tools** (30 min, 2 labs) - Tool abuse and output injection. Covers: how tool calling works, excessive agency risks, indirect injection via tool results, and XSS through AI-generated output. Labs: The Helpful Tool (discover and exploit hidden tools) and Output Injection (inject malicious links through AI output).

8. **LLM + Defenses** (35 min, 2 labs) - Bypassing system-level protections. Covers: keyword filters, instruction hierarchy, self-check prompts, topic locking, input/output classifiers, and defense-in-depth. Labs: Break the Defenses (bypass layered prompt rules) and The Vault (bypass code-level defense in depth).

### Agentic AI (1 module)

9. **LLM Agents & Agentic Security** (8 min) - Agentic applications can use tools via MCP (Model Context Protocol) and communicate through protocols such as A2A (Agent-to-Agent). The module explains how broad permissions and access to private data can turn prompt injection, poisoned content, or tool misuse into higher-impact outcomes such as code execution, data exfiltration, or account compromise. It includes the Lethal Trifecta framework and current research examples.

## Attack Labs (10 total, all free)

| Lab | Module | Difficulty | Objective |
|-----|--------|-----------|-----------|
| Hello, Injection | 1: Bare LLM | 1/5 | Extract a secret word from the system prompt using direct prompt injection |
| The Obedient Assistant | 1: Bare LLM | 2/5 | Trick the AI into generating misinformation despite safety instructions |
| Poisoned Knowledge | 2: External Data | 2/5 | Manipulate RAG retrieval to make the AI reveal a secret from poisoned documents |
| The Helpful Tool | 3: Tools | 3/5 | Discover a hidden tool and exploit it to extract sensitive information |
| Output Injection | 3: Tools | 3/5 | Inject clickable malicious links into AI-generated output |
| Break the Defenses | 4: Defenses | 4/5 | Extract a secret through multi-layered prompt defenses |
| The Vault | 4: Defenses | 5/5 | Bypass an output guard, canary token, and secondary LLM classifier |
| Nexus | 5: Agents | 3/5 | Exploit trust between a sandboxed renderer and its host page |
| Prism | 5: Agents | 4/5 | Find an unsanitized diagram-rendering path and trigger zero-click script execution |
| Vector | 5: Agents | 5/5 | Bypass an SVG sanitizer and execute script in the renderer |

## The Gauntlet (17-level Prompt Injection CTF)

A free, progressive capture-the-flag challenge where each level has a different AI defense system protecting a secret passphrase:

- **Levels 1-7 (Prompt Guards):** No defense, refusal rules, keyword filters, anti-jailbreak instructions, self-check prompts, topic locking, instruction hierarchy
- **Levels 8-11 (Code Guards):** Interaction limits, output regex guards, all defenses combined, canary token detection
- **Levels 12-17 (LLM Classifiers):** Input classifier, output classifier, triple guard (input + output + self-check), final boss (all defenses combined), dependency firewall, exchange classifier

## Interactive Tools (free, no signup)

- [Prompt Injection Cheat Sheet](https://prompttrace.airedlab.com/prompt-injection-cheatsheet): A searchable reference of 133 prompt injection techniques, jailbreaks, and evasions with example payloads, adapted from the Arcanum Prompt Injection Taxonomy (CC BY 4.0). Grouped into attack techniques (overriding instructions, jailbreaks, multi-turn, reasoning tricks, prompt/secret extraction, tool & agent abuse, automated attacks) and evasions (encodings, ciphers, hidden & look-alike text, other scripts, code/data formats, wordplay). Every technique is also a hands-on lab against a real model.
- [Reveal Trace](https://prompttrace.airedlab.com/reveal-trace): A free encode/decode workbench for obfuscated text across 60+ methods, including Base64, hex, binary, ROT13 and other ciphers, homoglyphs (look-alike characters), zero-width and invisible Unicode characters, Morse, and a bijection cipher. It shows how attackers hide prompt-injection payloads from input/output filters while the model still reads them, and lets defenders decode and detect those payloads. Paired with the Prompt Injection Cheat Sheet's evasion techniques.

## Frequently Asked Questions

**Q: What is prompt injection?**
A: Prompt injection is an attack where untrusted input manipulates an LLM into following unintended instructions. Depending on the surrounding application's data access and permissions, this can cause secret disclosure, fabricated information, or unauthorized actions. OWASP lists it as LLM01:2025 in the Top 10 for LLM Applications.

**Q: Is PromptTrace free?**
A: Yes, 100% free. All 9 learning modules are free to read. All 10 labs and the 17-level Gauntlet CTF require a free sign-in (GitHub or Google). There are no paid tiers or enterprise licensing.

**Q: What is the difference between direct and indirect prompt injection?**
A: Direct prompt injection is when attackers type malicious instructions into the chat input. Indirect prompt injection hides malicious instructions in external data (documents, web pages, emails) that the LLM processes through RAG or tool calling. Indirect injection is harder to detect because the payload enters through the data pipeline, not user input.

**Q: What is RAG poisoning?**
A: RAG poisoning is an attack where adversaries inject malicious content into the knowledge base used by a Retrieval-Augmented Generation system. The embedded instructions can override the LLM's system prompt when retrieved - a form of indirect prompt injection.

**Q: What is the Context Trace?**
A: Context Trace visualizes the prompt layers used for a request in real time - system instructions, RAG documents, tool definitions, and user input. Challenge secrets and other protected values may be redacted.

**Q: Do I need a cybersecurity background?**
A: No. PromptTrace starts from fundamentals - how LLMs work, what context windows are, how system prompts function. The 9 learning modules assume no prior security knowledge.

**Q: How does the Gauntlet CTF work?**
A: The Gauntlet is a 17-level capture-the-flag challenge. Each level has a progressively harder AI defense system protecting a secret passphrase. Defenses range from prompt-level rules to code-level guards to LLM classifiers. Your attempts and times are tracked on the leaderboard.

**Q: What LLM providers does PromptTrace use?**
A: PromptTrace rotates between multiple production-grade LLM providers for availability. All labs use real language models, not simulations.

## About the Creator

PromptTrace is built by Abdelrahman Adel, AI Security Researcher and Founder of AIRED Lab (AI Research, Education & Defense). He brings over 9 years of offensive security experience, is a Cyber Security Tech Leader, Top 100 Bug Bounty Hunter on Bugcrowd, and holds OSCP, CREST CRT, and WAPTX certifications. The curriculum is informed by the OWASP Top 10 for LLM Applications and the MITRE ATLAS framework for adversarial ML.

## Blog

- [Gandalf Alternatives: 11 Prompt Injection Games Compared](https://prompttrace.airedlab.com/blog/prompt-injection-game-alternatives): Comparison of 11 ways to practice prompt injection (Lakera Gandalf, GPT Prompt Attack, Tensor Trust, Wiz Prompt Airlines, Immersive Labs, Break The Prompt, PromptInjects, DoubleSpeak, PortSwigger Web LLM Attacks, Learn Prompting/HackAPrompt, HackTheBox) by format, price, real-LLM backend, level count, and best use case. It compares transparency, breadth, and defense coverage, including PromptTrace's layered Context Trace, 10 active labs, 17-level Gauntlet, defense module, and English/Arabic editions.
- [What Is Prompt Injection?](https://prompttrace.airedlab.com/blog/what-is-prompt-injection): Comprehensive guide covering definition, how it works, direct vs indirect types, real-world examples (Bing Chat/Sydney, Chevrolet chatbot), OWASP Top 10 ranking, how to practice safely, and defense strategies.
- [10 Prompt Injection Techniques with Examples](https://prompttrace.airedlab.com/blog/prompt-injection-examples): Hands-on guide to 10 techniques with example payloads: ignore previous instructions, role-play attacks, encoding/obfuscation, multilingual bypass, context overflow, indirect injection, RAG poisoning, tool abuse, output injection, and defense bypass.
- [Prompt Injection vs Jailbreaking](https://prompttrace.airedlab.com/blog/prompt-injection-vs-jailbreaking): Explains the key differences between prompt injection (targets application layer) and jailbreaking (targets model safety training) across 5 dimensions: target, attacker goal, victim, techniques, and severity.
- [Prompt Injection Defenses: How to Read the Cheat Sheet & Stop Attacks](https://prompttrace.airedlab.com/blog/prompt-injection-cheat-sheet): A defense-focused companion to the interactive cheat sheet. Each attack category (direct injection, indirect injection, encoding, role-play, tool exploitation, defense bypass) is paired with how it works and how to defend against it, with links to test the evasions live in Reveal Trace.
- [AI Jailbreak Techniques: DAN, Roleplay, Encoding, and Multi-Turn](https://prompttrace.airedlab.com/blog/ai-jailbreak-techniques): The main families of jailbreak techniques, why each bypasses safety (safety is learned behavior, not an enforced rule), and how to defend. Covers roleplay/DAN personas, fake authority and framing, encoding and obfuscation, multi-turn/crescendo attacks, and reasoning exploits.
- [Homoglyph Attacks: How Look-Alike Characters Fool AI Filters](https://prompttrace.airedlab.com/blog/homoglyph-attacks): How swapping letters for confusable Unicode characters (e.g. Cyrillic look-alikes) slips banned words past exact-match keyword filters while the model still reads them, plus normalization-based defenses.
- [Zero-Width Characters & Unicode Steganography](https://prompttrace.airedlab.com/blog/zero-width-unicode-steganography): How invisible/zero-width Unicode characters hide instructions from human reviewers while LLMs still process them (especially in indirect prompt injection), and how to detect and strip them.
- [How to Learn LLM Security in 2026](https://prompttrace.airedlab.com/blog/how-to-learn-llm-security): A 5-step practical roadmap covering fundamentals, attack surfaces, hands-on practice, frameworks (OWASP, MITRE ATLAS), and building/breaking your own systems.
- [What Is AI Red Teaming?](https://prompttrace.airedlab.com/blog/what-is-ai-red-teaming): AI red teaming explained - what it is, how it differs from traditional red teaming, common methods (prompt injection, data poisoning, tool abuse, defense bypass), and how to get started.

## AI Security Resource Directory

PromptTrace maintains a curated directory of 70+ AI security resources across 4 categories. Resources are reviewed for accuracy, relevance, and quality, and dead links are removed or corrected as they are found. The directory is community-contributable and prioritizes practitioner value over quantity.

### AI Security Tools (39 resources)
Open-source and commercial tools for testing, scanning, and defending AI systems. Includes vulnerability scanners (garak, promptfoo), red teaming frameworks (PyRIT, PurpleLlama), guardrails (NeMo Guardrails, LLM Guard, Guardrails AI), and agent security tools (Agentic Radar, MCP Scanner, Invariant).
- [Browse AI Security Tools](https://prompttrace.airedlab.com/resources/tools)

### AI Security Labs & CTFs (7 resources)
Hands-on environments for practicing AI red teaming. Includes PromptTrace (prompt injection labs with Context Trace), Gandalf (wargame), Damn Vulnerable LLM Agent, and Vulnerable MCP Servers Lab.
- [Browse AI Security Labs](https://prompttrace.airedlab.com/resources/labs)

### AI Security Certifications (7 resources)
Professional certifications for AI security practitioners. Covers OSAI+ (OffSec AI Red Teamer), CAISP (Certified AI Security Professional), HTB COAE (Certified Offensive AI Expert), GAISP (GIAC AI Security Professional), and CompTIA SecAI+.
- [Browse AI Certifications](https://prompttrace.airedlab.com/resources/certifications)

### AI Security Communities (18 resources)
Newsletters, open-source projects, and researchers tracking AI threats. Includes Simon Willison's Weblog, AI Village (DEF CON), Awesome LLM Security, HiddenLayer Research, and Mozilla's 0din GenAI Bug Bounty.
- [Browse AI Communities](https://prompttrace.airedlab.com/resources/communities)


## Arabic Edition (النسخة العربية)

PromptTrace's homepage and all learning modules are fully translated into Arabic, served under /ar. Egypt is PromptTrace's #1 audience. Technical terms of art (prompt injection, RAG, LLM, system prompt) are kept in English inline within Arabic prose, matching Arab infosec writing convention.

- الصفحة الرئيسية (Home): https://prompttrace.airedlab.com/ar
- التعلّم (Learn hub): https://prompttrace.airedlab.com/ar/learn
- كيف تعمل نماذج LLM: https://prompttrace.airedlab.com/ar/learn/how-llms-work
- System Prompts: https://prompttrace.airedlab.com/ar/learn/system-prompts
- شرح RAG: https://prompttrace.airedlab.com/ar/learn/rag-explained
- الأدوات واستدعاء الدوال: https://prompttrace.airedlab.com/ar/learn/tools-and-function-calling
- النموذج المجرّد (The Bare LLM): https://prompttrace.airedlab.com/ar/learn/the-bare-llm
- LLM والبيانات الخارجية: https://prompttrace.airedlab.com/ar/learn/llm-external-data
- LLM والأدوات: https://prompttrace.airedlab.com/ar/learn/llm-tools
- دفاعات LLM: https://prompttrace.airedlab.com/ar/learn/llm-defenses
- أمن الأنظمة الوكيلة (Agentic Security): https://prompttrace.airedlab.com/ar/learn/agentic-security
- المدوّنة (Blog): https://prompttrace.airedlab.com/ar/blog
- بدائل Gandalf: مقارنة بين 11 لعبة ومختبراً لـ prompt injection: https://prompttrace.airedlab.com/ar/blog/prompt-injection-game-alternatives
- ما هو prompt injection؟: https://prompttrace.airedlab.com/ar/blog/what-is-prompt-injection
- 10 تقنيات لـ prompt injection مع أمثلة: https://prompttrace.airedlab.com/ar/blog/prompt-injection-examples
- prompt injection مقابل jailbreak: https://prompttrace.airedlab.com/ar/blog/prompt-injection-vs-jailbreaking
- مرجع سريع لـ prompt injection: https://prompttrace.airedlab.com/ar/blog/prompt-injection-cheat-sheet
- كيف تتعلّم أمن LLM في 2026: https://prompttrace.airedlab.com/ar/blog/how-to-learn-llm-security
- ما هو AI Red Teaming؟: https://prompttrace.airedlab.com/ar/blog/what-is-ai-red-teaming

## Links

- [Homepage](https://prompttrace.airedlab.com)
- [Learn](https://prompttrace.airedlab.com/learn)
- [Labs](https://prompttrace.airedlab.com/labs)
- [Gauntlet](https://prompttrace.airedlab.com/gauntlet)
- [Prompt Injection Cheat Sheet](https://prompttrace.airedlab.com/prompt-injection-cheatsheet)
- [Reveal Trace](https://prompttrace.airedlab.com/reveal-trace)
- [Resources](https://prompttrace.airedlab.com/resources)
- [Leaderboard](https://prompttrace.airedlab.com/leaderboard)
- [About](https://prompttrace.airedlab.com/about)
- [Blog](https://prompttrace.airedlab.com/blog)
- [Privacy Policy](https://prompttrace.airedlab.com/privacy)
- [Terms of Service](https://prompttrace.airedlab.com/terms)