Prompt Injection
LLM01Why a model cannot tell your rules apart from a document it was handed, and what attackers do with that gap.
Free course · five steps · start from zero
Learn to guard
AI, from nothing.
A self-taught path that begins at "what actually is a model" and ends with you building a small AI application on your own laptop and testing it yourself. Five steps, all free. Written in plain language, with no mathematics and nothing assumed.
Start with a 60 second round · 5 free steps · no sign up needed to read or play · or play the game
Where do you want to start?
Pick the door that fits you.
I'm new to AI
Start at "what actually is a model". The first part of step 1 takes about 15 minutes and assumes nothing.
Step 1, part 1 →
I build AI features
See the attacks your feature will meet, each with the tell that catches it and the innocent message that looks the same.
Step 2 →
I work in security
Go straight to the defences and what each one misses, then test your instincts in the game.
Step 3, then the game →
New · in The Filter Pro
See real breaches happen, then fix them.
Ten hands-on labs built from vulnerabilities that were actually disclosed this year, several exploited in the wild. You see how each one happened, build a tiny version of the flaw, break it yourself, then apply the fix, with a one-file kit for your own machine.
Start here
The chat box is the door, not the building.
Most people meet artificial intelligence through a chat window and reasonably assume that the window is the system. It is the entrance.
Behind it sit the parts that make the product useful, and those are the parts that can be turned against you.
The one idea
A filter that blocks everything is not a good filter.
Catching every attack is easy. Block all traffic and your breach count is zero.
No working product does that, because it would be useless. Even so, almost every course on this subject teaches only how to spot the hostile one.
You get scored on two numbers here, not one. Every single time.
Number one
The attacks you missed
The hostile message you waved through. Instructions buried inside a document your assistant was asked to read. Something that cost your company money.
Number two
The people you blocked
The real customer you turned away. The trainer asking a fair question. The person writing in other unpopular languages. The developer whose work you just broke.
Real systems live between those two numbers. You cannot move one without paying in the other. Everything on this site teaches you to feel that tradeoff instead of reading a definition of it.
Try it now
Grade a filter in ten seconds.
Put in the numbers a vendor would quote you, or the ones from a system you already run. The calculator works out what those percentages do once they meet real traffic, and gives the result a grade.
Nothing is sent anywhere. The whole thing runs in this page.
–
Enter some numbersThe two on the right are the ones a vendor publishes. The two on the left are the ones only you know.
–Attacks caught
–Attacks missed
–People blocked in error
–Precision
Try the last preset. A filter catching 99.9% of attacks while wrongly flagging only 0.1% would be world class, and no vendor will sell you one. It still blocks roughly one innocent person for every attack it catches. That is what rarity does to any detector, and step 1 works through why.
The free course
Five steps. Read them in order.
This is the whole thing, open, with no sign up needed to read or play. It is written for one person learning alone. Each step tells you what you will be able to do by the end of it.
By step 4 you are building a working AI application on your own laptop with free open-source software, then breaking it deliberately to see the flaw for yourself.
Step 1 · start here
How it works, and where it breaks
Start at zero. How a model is made, the six parts of an AI application, one request traced end to end, the four shapes, and the seven places it all goes wrong.
Step 2What the attacks look like
Twenty-seven tricks in eight groups. Each one gives the tell that catches it, and the completely innocent message that looks exactly the same. No working payloads.
Step 3Solutions
Twelve fixes in the order worth building them. Each one says what it stops, what it misses, and what it costs. Ends with a four-week plan you could hand to an engineer.
Step 4 · hands onBuild one yourself
The step where you stop reading and start building. Two browser tools, then a walkthrough: run an open model on your laptop, wrap it in an application, watch a document take it over, and repair it with three of the controls.
Step 5Resources
The twenty sources this course rests on, graded by the kind of evidence each represents, with an honest note on what every one of them does not establish.
Read them in that order and you go from not knowing what a model is to building one into an application and defending it. If you have only fifteen minutes, read part 1 of step 1, or play today's prompt.
Why this one
Everyone else hands you the attacker's chair.
There are good games about breaking a model. Trick the bot, steal the password, climb the levels. They are fun, and they teach you attacking.
Very few of them build the other seat, which is the one people are actually employed to occupy. Here you are the thing standing between the attack and the model, which is the job security engineers, AI product teams and platform owners are hired to do. Every level maps to a named, published risk, so what you learn carries a term you can use in a design review.
It also means nothing here teaches you to build a working attack. That is the point, and it is why this is the version you can run inside a company.
The full game
Then practise, until it is a reflex.
Reading about a trick and catching one are different skills. The game puts you in the seat for 35 decisions across seven units.
One idea, then practice. Another idea, then practice. Never more than two exercises before something new arrives, so it never turns into a quiz you grind through.
Disguises
EVASIONEncoding, switching language, mixed case, and invisible characters. The same attack wearing a costume your filter cannot read.
Hidden Context Exposure
LLM08Asking outright, filling in the blank, and sizing attacks that map your rules and your tool list without ever quoting them.
Excessive Agency
LLM03What happens when an over-permissioned agent reads a poisoned invoice. A trick plus tools is remote control.
Document Store Attacks
LLM05 / 08Attacking the knowledge base instead of the message, plus one customer's search quietly returning another customer's data.
Output and Supply Chain
LLM10 / 03Model output run as a database query or drawn as a web page, and the unchecked file that runs code the moment you load it.
Combined Attacks
BOSSChained tricks. Attacks planted four messages early. Nothing looks decisive on its own.
How it drills
Three ways to be wrong about the same attack.
Seeing a trick once is trivia. Meeting it from three directions is a reflex.
Allow or block
A message arrives. You make the call. Twenty-two of these, and eight of them are real people you should never have stopped.
Tap the attack
A document, a web page, a fetched chunk. One piece of it is an order. Find it before your assistant obeys it.
Name the technique
Read the system, name the flaw. This is the part that turns a gut feeling into words you can use in a meeting.
Full Part of the full game
Build it. Break it. Filter it.
You have been the filter. Now build the thing the filter protects, break it yourself, then defend it. The Build & Break Lab is a full section of the paid game, next to the units and the Practice Range.
01 · BUILD
Build it.
Run an open-weights model on your own laptop, then build a small Notes Assistant around it. It lists your notes, reads one, and does the sums. In plain Python, or with no code at all in n8n.
02 · BREAK
Break it.
Plant four attacks in its notes and watch your own agent fall for them. A hidden instruction. A file outside its folder. A tool turned against it. A jailbreak. Every one is something you already learned to spot.
03 · FILTER
Filter it.
Add five layers of defence, run every attack again, and fill in a scorecard that does not flatter you. Then a capstone: five new attack notes, and a badge for surviving them.
What you build
A real AI agent, then a defended one
A Notes Assistant that runs on your own computer, reads your files and uses tools. Then the same agent with five layers of defence around it.
What you can do afterwards
Skills you can name on a CV
- Run and size local AI models
- Build a tool-using agent, in code or no-code
- Test an AI app for prompt injection
- Add defences and measure them honestly
- Write a short red team findings report
When you would use it
Before an AI feature ships
- Your team wants to connect an assistant to company documents
- You are asked to review or test an AI feature
- You are moving towards an AI security role
You only need a laptop. Everything runs on your own machine with fake data, with no cloud account. Every step says in one line what to do next, so it works if this is your first time. It is the same method enterprise security teams use to test AI systems in an isolated test lab, so it carries over to work. Only ever test systems you own or have written permission to test.
- Stage 1Run itLocal models, open weights versus open source, quantization, and a calculator that checks your machine first.
- Stage 2Build itA model, a loop and tools. The agent, step by step, in code or in n8n.
- Stage 3Break itFour attacks, scripted replays and transcript drills.
- Stage 4Filter itSpotlighting, least privilege, a human in the loop, input filters, output checks.
- CapstoneRed team itFive new notes against your own defended agent, then a findings report.
Local model setup
LM Studio for a gentle start, Ollama for the real thing, on Windows, macOS or Linux. Written for people who have never run a model.
Code or no-code
Both paths build the same agent, so you can compare them. A toggle remembers your choice. Shared steps need no choice at all.
The hardware calculator
Tell it your memory and graphics card, and it rates each model size as comfortable, slow or too big. The calculator itself lives inside the paid game.
Attack and defence labs
Real attack notes against your own agent, mapped back to the units you already played, with an honest scorecard at the end.
A starter kit
The Python for every step, a sandbox of fake notes, the attack and capstone notes, and a scorecard, in one download.
Safe by design
Fake data only, one sandbox folder, and your own machine. Nothing here touches a real account.
Get the Build & Break Lab$79with Pro
Included with the full game. One payment.
Included in The Filter Pro, with ten incident labs and new ones as vulnerabilities are disclosed.
Get it
The course is free. The practice is $79.
The course is free. Pro is where you break real breaches.
You never have to pay anything. All five steps stay open, and so does a new prompt every day. The Filter Pro is the full game plus a new attack every month, because the attacks keep changing.
Founding members: $39 a year instead of $59, for as long as you stay. Pro opens on 1 December 2026, and founders get the full game today.
25 of 25 founding places left
Free
$0
The whole course, a daily round and the first unit of the game.
- All five steps of the course
- Both browser tools
- Unit 1 of the game, Prompt Injection, in full
- Today's prompt, every day
- The incident labs catalogue
- Units 2 to 7, the Practice Range and the Lab
- Monthly attack packs and the certificate
Full training (one-time)
$79
One payment. Yours permanently, core updates included.
- All 7 units, 35 exercises, 19 lessons
- Real world impact on every answer
- Boss unit on chained attacks
- Build & Break Lab: run a model, build an agent, break it, defend it
- Starter kit download and a hardware calculator
- Practice Range, credited to Arcanum
- Downloadable certificate
- Opens in your browser with your key. No account, no tracking
- Monthly attack packs (those come with Pro)
The Filter Pro
Soon
Everything in the full game, plus a new attack pack and mini lab on the 1st of every month. Opens 1 December 2026.
- 10 incident labs from real, recently disclosed breaches: build, break and fix each one
- Everything in the full game, online: all 7 units, the Practice Range and the Lab
- New labs and attack packs added as new vulnerabilities are disclosed
- A matching Build & Break mini lab with each pack
- The full pack archive and the daily prompt archive
- A badge for every pack you finish
- Up to 3 devices. Cancel any time in Gumroad
Best value
The Filter Pro, yearly
$39$59 a year
Founding price, kept for as long as you stay. Usually $59 a year.
About $4.92 a month. Cancel any time.
- 10 incident labs from real, recently disclosed breaches: build, break and fix each one
- Everything in the full game, online: all 7 units, the Practice Range and the Lab
- New labs and attack packs added as new vulnerabilities are disclosed
- A matching Build & Break mini lab with each pack
- The full pack archive and the daily prompt archive
- A badge for every pack you finish
- Up to 3 devices. Cancel any time in Gumroad
Bought the one-time game before? Everything you bought stays yours, including every core update, and your purchase key still opens it. The incident labs and the packs are new content made after your purchase, so they come with Pro.
Browse every lab in the incident labs.
Questions
Before you start.
I know nothing about AI. Is this really for me?
Yes, and that is precisely who it was written for. Step 1 assumes you have never encountered the word prompt, and every new term is defined in plain language the first time it appears. If a sentence anywhere on this site has to be read twice, treat that as a fault and tell me about it.
Do I need to write code?
Not for steps 1 to 3, or for step 5. Those are written for anybody who ships or reviews AI features. Step 4 does have you build something, and it supplies every line you need. If you can follow a recipe, you can complete it.
Will I actually be able to build something at the end?
Yes. Step 4 walks you through running an open-source model on your own laptop, wrapping it in a small application, feeding it a document it did not write, and watching the flaw occur. You then repair it using three of the controls from step 3 and measure both numbers.
How do I get into the full game?
It opens in your browser at private.hamcodes.com. You paste your key once on each device, and progress saves in that browser. There is nothing to install and no account to create. The Build & Break Lab's starter kit is a download you run on your own laptop.
What happens to my one-time purchase?
Nothing is taken away. Everything you bought stays yours, with every core update, exactly as it was sold. Your purchase key keeps working. Monthly attack packs are new content made after your purchase, so they come with Pro, and past buyers are offered the founding price.
Can I cancel Pro any time?
Yes. You manage the membership in your Gumroad library and cancel with one click. You keep access until the end of the period you already paid for, and your progress and badges stay in your browser if you come back.
Does Pro track me?
We count anonymous clicks to improve the course: which exercises people miss, whether a new pack gets opened. No cookies for tracking, no ads, no IP addresses, no emails, and nothing at all if your browser sends Global Privacy Control or Do Not Track. Your licence key is checked with Gumroad, which is where you paid. The one-time game sends no events at all.
What is in a monthly pack?
One attack family, released on the 1st of the month: two to four short lessons, eight to ten exercises in the game's three formats, and a matching mini lab for the Build & Break agent you built. Every example is deliberately broken, so it teaches the shape without working. Finishing a pack earns its badge. See the incident labs.
Is this teaching people how to attack AI systems?
It teaches the opposite. You never construct an attack. You classify incoming ones, learn the signal that reveals them, and then see what missing one would have cost. Examples are broken deliberately, so that they teach the shape without functioning. The material is written to be safe to run inside a company.
How long does the whole thing take?
About three hours to read the five steps, plus an hour for the build lab. Step 1 is the long one at around 45 minutes, so it comes in three parts of about fifteen minutes, each ending with a save point. Today's prompt takes one minute. The game is another 45 to 70 minutes. Most people work through it across several sittings, and progress saves in your browser.
Is it kept up to date?
Yes. The core game is updated as the published Top 10 for LLM applications changes, and those updates are included for everyone who bought it. New attack families arrive as monthly packs in Pro, and the free course and the daily prompt keep moving too.
Can I use it to train my team?
Yes. For a small team, a membership each works fine, and the free course and the daily prompt are open to everyone. If you want to run it as internal training, cover a classroom, or put your own name on it, get in touch and we will sort out a licence.
Start
You already made three of these decisions.
Today's prompt takes sixty seconds. Part 1 of step 1 takes about fifteen minutes and assumes no prior knowledge whatsoever. That is the entire commitment.