# PromptTrace

License: CC-BY-4.0

> PromptTrace is a free, hands-on AI security training platform where you practice prompt injection, RAG poisoning, and tool exploitation against real LLMs. Its Context Trace visualizes the prompt layers used for a request - system instructions, RAG documents, tool definitions, and user input - while challenge secrets and other protected values may be redacted. Built by Abdelrahman Adel, AI Security Researcher with 9+ years of offensive security experience (OSCP, CREST CRT, Bugcrowd Top 100).

- URL: https://prompttrace.airedlab.com
- Pricing: 100% free, no paid tiers
- LLM Providers: Multiple production-grade LLMs, rotated for availability
- Curriculum references: OWASP Top 10 for LLM Applications 2025, OWASP Top 10 for Agentic Applications 2026 (risks facing autonomous and agentic systems), and MITRE ATLAS

## Learning Modules (9 total, free)

- [How LLMs Work](https://prompttrace.airedlab.com/learn/how-llms-work): Tokenization, context windows, and text generation fundamentals
- [System Prompts](https://prompttrace.airedlab.com/learn/system-prompts): How system prompts shape LLM behavior and their security limits
- [RAG Explained](https://prompttrace.airedlab.com/learn/rag-explained): Retrieval-augmented generation pipelines and trust boundaries
- [Tools and Function Calling](https://prompttrace.airedlab.com/learn/tools-and-function-calling): How LLMs interact with external systems via tool calling
- [The Bare LLM](https://prompttrace.airedlab.com/learn/the-bare-llm): Direct prompt injection against unprotected models
- [LLM + External Data](https://prompttrace.airedlab.com/learn/llm-external-data): RAG poisoning and indirect prompt injection
- [LLM + Tools](https://prompttrace.airedlab.com/learn/llm-tools): Tool abuse, excessive agency, and improper output handling
- [LLM + Defenses](https://prompttrace.airedlab.com/learn/llm-defenses): Bypassing system-level protections and defense-in-depth
- [LLM Agents & Agentic Security](https://prompttrace.airedlab.com/learn/agentic-security): MCP, A2A, the Lethal Trifecta, and why agents amplify prompt injection

## Prompt Injection Labs (10 free labs with real LLMs)

- [Hello, Injection](https://prompttrace.airedlab.com/labs/hello-injection): Extract a secret from the system prompt using direct prompt injection (Difficulty: 1/5)
- [The Obedient Assistant](https://prompttrace.airedlab.com/labs/obedient-assistant): Trick AI into generating misinformation (Difficulty: 2/5)
- [Poisoned Knowledge](https://prompttrace.airedlab.com/labs/poisoned-knowledge): RAG retrieval manipulation with document poisoning (Difficulty: 2/5)
- [The Helpful Tool](https://prompttrace.airedlab.com/labs/helpful-tool): Hidden tool discovery and exploitation (Difficulty: 3/5)
- [Output Injection](https://prompttrace.airedlab.com/labs/output-injection): XSS through AI-generated HTML output (Difficulty: 3/5)
- [Break the Defenses](https://prompttrace.airedlab.com/labs/defend-the-bot): Extract a secret through multi-layered prompt defenses (Difficulty: 4/5)
- [The Vault](https://prompttrace.airedlab.com/labs/the-vault): Bypass an output guard, canary token, and secondary LLM classifier (Difficulty: 5/5)
- [Nexus](https://prompttrace.airedlab.com/labs/nexus): Exploit trust between a sandboxed renderer and its host page (Difficulty: 3/5)
- [Prism](https://prompttrace.airedlab.com/labs/prism): Find an unsanitized diagram-rendering path and trigger zero-click script execution (Difficulty: 4/5)
- [Vector](https://prompttrace.airedlab.com/labs/vector): Bypass an SVG sanitizer and execute script in the renderer (Difficulty: 5/5)

## The Gauntlet (Free 17-Level Prompt Injection CTF)

- [Gauntlet](https://prompttrace.airedlab.com/gauntlet): 17-level capture-the-flag challenge with progressively hardened AI systems
- Levels 1-7: Prompt Guards (refusal rules, keyword filters, anti-jailbreak, self-check, topic locking, instruction hierarchy)
- Levels 8-11: Code Guards (interaction limits, output regex, combined defenses, canary tokens)
- Levels 12-17: LLM Classifiers (input classifier, output classifier, triple guard, final boss, dependency firewall, exchange classifier)

## Interactive Tools (free, no signup)

- [Prompt Injection Cheat Sheet](https://prompttrace.airedlab.com/prompt-injection-cheatsheet): Searchable reference of 133 prompt injection techniques, jailbreaks, and evasions with example payloads, adapted from the Arcanum PI Taxonomy. Each technique is also a hands-on lab against a real model.
- [Reveal Trace](https://prompttrace.airedlab.com/reveal-trace): Encode and decode obfuscated text across 60+ methods (Base64, homoglyphs, zero-width and invisible characters, ROT13, Morse, bijection cipher) to see how attackers hide payloads from LLM filters and how defenders decode them.

## Key Concepts

- **Prompt Injection:** An attack where untrusted input manipulates an LLM into following unintended instructions; OWASP lists it as LLM01:2025 in the Top 10 for LLM Applications.
- **Indirect Prompt Injection:** Malicious instructions hidden in external data (documents, web pages, emails) that the LLM processes through RAG or tool calling.
- **RAG Poisoning:** Injecting adversarial content into RAG knowledge bases so the LLM retrieves and follows attacker-controlled instructions.
- **Excessive Agency:** An LLM-based system can perform damaging actions when it has excessive functionality, permissions, or autonomy (LLM06:2025 in the OWASP Top 10 for LLM Applications).
- **Context Trace:** A real-time view of the prompt layers used for a request; challenge secrets and other protected values may be redacted.

## Blog

- [What Is Prompt Injection?](https://prompttrace.airedlab.com/blog/what-is-prompt-injection): Definition, examples, direct vs indirect types, and how to defend against OWASP's LLM01:2025 risk
- [10 Prompt Injection Techniques](https://prompttrace.airedlab.com/blog/prompt-injection-examples): Hands-on guide with example payloads you can try today
- [Prompt Injection vs Jailbreaking](https://prompttrace.airedlab.com/blog/prompt-injection-vs-jailbreaking): Key differences in goals, targets, techniques, and severity
- [Prompt Injection Defenses: How to Read the Cheat Sheet & Stop Attacks](https://prompttrace.airedlab.com/blog/prompt-injection-cheat-sheet): Defense-focused companion to the interactive cheat sheet, covering each attack category and how to harden against it
- [AI Jailbreak Techniques](https://prompttrace.airedlab.com/blog/ai-jailbreak-techniques): DAN and roleplay, fake authority, encoding, multi-turn, and reasoning exploits, with how each bypasses safety and how to defend
- [Homoglyph Attacks](https://prompttrace.airedlab.com/blog/homoglyph-attacks): How look-alike Unicode characters slip banned words past AI keyword filters, and how to detect and defend
- [Zero-Width Characters & Unicode Steganography](https://prompttrace.airedlab.com/blog/zero-width-unicode-steganography): Hiding instructions from humans while LLMs still read them, and how to detect it
- [How to Learn LLM Security in 2026](https://prompttrace.airedlab.com/blog/how-to-learn-llm-security): 5-step roadmap for AI security careers
- [What Is AI Red Teaming?](https://prompttrace.airedlab.com/blog/what-is-ai-red-teaming): Methods, tools, and how to get started
- [Prompt Injection Games: 11 Gandalf Alternatives Compared](https://prompttrace.airedlab.com/blog/prompt-injection-game-alternatives): Honest comparison of 11 ways to practice prompt injection by format, price, real-LLM backend, level count, and best use case

## AI Security Resource Directory (70+ curated resources)

- [All Resources](https://prompttrace.airedlab.com/resources): 70+ curated AI security tools, labs, certifications, and communities
- [AI Security Tools](https://prompttrace.airedlab.com/resources/tools): 39 open-source and commercial tools for LLM security testing
- [AI Security Labs & CTFs](https://prompttrace.airedlab.com/resources/labs): Hands-on practice environments for AI red teaming
- [AI Security Certifications](https://prompttrace.airedlab.com/resources/certifications): OSAI+, CAISP, HTB COAE, GAISP, and other AI security credentials
- [AI Security Communities](https://prompttrace.airedlab.com/resources/communities): Newsletters, open-source projects, and researchers tracking AI threats

## Arabic (العربية)

The learning modules, labs, gauntlet, resources, and blog are fully translated into Arabic, served under /ar (Egypt is PromptTrace's #1 audience).

- [PromptTrace بالعربية](https://prompttrace.airedlab.com/ar): Arabic homepage
- [التعلّم](https://prompttrace.airedlab.com/ar/learn): All 9 learning modules in Arabic
- [المختبرات](https://prompttrace.airedlab.com/ar/labs): Prompt injection labs in Arabic
- [Gauntlet](https://prompttrace.airedlab.com/ar/gauntlet): The 17-level prompt injection CTF in Arabic
- [المصادر](https://prompttrace.airedlab.com/ar/resources): AI security resource directory in Arabic
- [حول PromptTrace](https://prompttrace.airedlab.com/ar/about): About page in Arabic
- [المدوّنة](https://prompttrace.airedlab.com/ar/blog): Blog index in Arabic
- [ما هو prompt injection؟](https://prompttrace.airedlab.com/ar/blog/what-is-prompt-injection): Arabic pillar guide to prompt injection
- [بدائل Gandalf: مقارنة ألعاب prompt injection](https://prompttrace.airedlab.com/ar/blog/prompt-injection-game-alternatives): Arabic comparison of prompt injection practice games
- [ورقة مرجع هجمات Prompt Injection](https://prompttrace.airedlab.com/ar/prompt-injection-cheatsheet): Interactive 133-technique cheat sheet with Arabic explanations
- [Reveal Trace](https://prompttrace.airedlab.com/ar/reveal-trace): Encode/decode obfuscated text tool with Arabic explanations
- [تقنيات كسر حماية الذكاء الاصطناعي](https://prompttrace.airedlab.com/ar/blog/ai-jailbreak-techniques): Arabic guide to AI jailbreak techniques
- [هجمات المحارف المتشابهة](https://prompttrace.airedlab.com/ar/blog/homoglyph-attacks): Arabic guide to homoglyph attacks
- [المحارف عديمة العرض وإخفاء النص](https://prompttrace.airedlab.com/ar/blog/zero-width-unicode-steganography): Arabic guide to zero-width Unicode steganography

## Links

- [Learn](https://prompttrace.airedlab.com/learn)
- [Labs](https://prompttrace.airedlab.com/labs)
- [Gauntlet](https://prompttrace.airedlab.com/gauntlet)
- [Prompt Injection Cheat Sheet](https://prompttrace.airedlab.com/prompt-injection-cheatsheet)
- [Reveal Trace](https://prompttrace.airedlab.com/reveal-trace)
- [Resources](https://prompttrace.airedlab.com/resources)
- [Leaderboard](https://prompttrace.airedlab.com/leaderboard)
- [About](https://prompttrace.airedlab.com/about)
- [Blog](https://prompttrace.airedlab.com/blog)