Prompt Injection
Why a model cannot tell your instructions apart from the document it was handed, and what attackers do with that gap.
OWASP LLM Top 10 · 2026
Every guardrail
gets two numbers.
The attacks you missed. And the real people you blocked by mistake. The Filter AI puts you in the guardrail seat of an AI assistant and scores you on both.
7 units · 35 exercises · 19 lessons · instant download · no account needed
The idea
A filter that blocks everything is not a good filter.
It is the easiest thing in the world to catch every attack. Block all traffic and your breach count is zero. Nobody builds that, because it does not work, and yet almost every course on this subject only ever teaches you to spot the bad one.
Counter one
Breaches
The attack you waved through. Prompt injections, jailbreaks, encoded payloads, instructions buried inside a document your assistant was asked to read.
Counter two
False alarms
The real user you turned away. The security trainer asking a fair question. The customer writing in Vietnamese. The developer whose work you just broke.
Real detection systems live between those two numbers. Machine learning calls it precision and recall. Every exercise in The Filter AI is scored on both, so you learn the tradeoff by feeling it, not by reading a definition of it.
Curriculum
Seven units. Taught the way you actually learn.
One idea, then practice. Another idea, then practice. Never more than two exercises before something new arrives, so nothing turns into a quiz you grind through.
Evasion Techniques
Base64, language switching, mixed case, and invisible Unicode. The same attack wearing a disguise your filter cannot read.
Hidden Context Exposure
Direct asks, fill in the blank, task wrappers, and sizing attacks that map your rulebook, your retrieved context and your tool list without ever quoting them.
Excessive Agency
What happens when an over-permissioned agent reads a poisoned invoice. Injection plus tools is remote control.
RAG and Vector Poisoning
Attacking the knowledge base instead of the prompt, plus cross-tenant retrieval leaks in shared vector stores.
Output and Supply Chain
Model output executed as SQL or HTML, and the unscanned pickle file that runs code the moment you load it.
Combined Attacks
Chained techniques. Multi-turn payloads planted four messages early. Nothing looks decisive on its own.
How it drills
Three ways to be wrong about the same attack.
Seeing a technique once is trivia. Meeting it from three directions is a reflex.
Allow or block
A prompt arrives. You make the call. Twenty two of these, and eight of them are legitimate users you should never have stopped.
Tap the injection
A document, a webpage, a retrieved chunk. One span in it is an instruction. Find it before your assistant obeys it.
Name the technique
Read the architecture, classify the flaw. This is the part that turns instinct into language you can use in a review.
Why this one
Everyone else hands you the attacker's chair.
There are good games about breaking a model. Trick the bot, extract the password, climb the levels. They are fun, and they teach you offense.
Almost nobody builds the other seat. The Filter AI is the defender's version: you are the thing standing between the attack and the model, which is the job actual security engineers, AI product teams, and platform owners are hired to do. Every level is anchored to a risk in the OWASP Top 10 for LLM Applications, so what you learn has a name you can bring into a design review or a threat model.
It also means nothing here teaches you to build a working jailbreak. That is the point, and it is why this is the version you can run inside a company.
Free reference
The whole reference is open. Read it before you spend anything.
Four pages, no sign up, no email. The same material the training is built on, written to be used in a design review and to be taught from. If you never buy the game, these are still yours.
Start here
How it's built
How a model is trained, the six primitives every AI application is made of, the request traced end to end, and four reference architectures with the trust boundaries drawn on.
Understand itField guide
The seven layers of the attack surface, the OWASP LLM Top 10 mapped onto them, and the arithmetic that decides whether a guardrail is worth deploying.
Build itDefence patterns
Twelve controls in the order worth building them. Each one says what it stops, what it does not stop, and what it costs you.
Recognise itAttack index
Twenty-four techniques across eight families, each with its tell and the legitimate traffic that looks identical. No working payloads.
Try itLabs
A payload inspector that reveals hidden Unicode and encodings, and a base rate calculator that prices your false alarms. Both run in your browser.
Check itSource desk
The primary work everything here rests on, graded by evidence type and dated, each with a line on what it does not prove.
Six pages, no sign up, no email. Read in that order and you go from how the machine works to what breaks it to what to build instead.
Get it
Start free. Pay once for the rest.
Free
$0
Unit one, in your browser, right now.
- Prompt injection unit in full
- 4 lessons, 5 exercises
- Progress saved in your browser
- Units two through seven
- Completion certificate
Full training
$39.90
One payment. Yours permanently, including updates.
- All 7 units, 35 exercises, 19 lessons
- Every OWASP LLM Top 10 risk covered
- Real world impact on every answer
- Boss unit on chained attacks
- Practice Range: a curated route through vetted free labs and tools, credited to Arcanum
- Downloadable certificate
- Runs offline, no account, no tracking
Questions
Before you buy.
What do I actually download?
A folder you open in any browser. Double click one file and the whole game runs locally. There is no installer, no sign up, no server call, and nothing to keep paying for. It also works offline once you have it.
Do I need to write code or run anything?
No. If you can open a web page you can use this. Developers get more out of the architecture units, but every exercise is written to be understood without reading a line of code.
Is this teaching people how to attack AI systems?
The opposite. You never craft an attack. You classify incoming ones and learn the tell, then the exercise shows what missing it would have cost. It is written to be safe to run inside a company, which is exactly why the defender seat matters.
How long does it take?
Around 45 to 70 minutes to work through everything once. Most people do it across a few sittings, since progress saves automatically in your browser.
Is it kept up to date?
Yes, and updates are included in the one payment. The content is built on the OWASP Top 10 for LLM Applications and on notes I publish openly while I learn, so it moves as the attacks do.
Can I use it to train my team?
For a small team, buying seats works fine. If you want to run it as internal training or brand it as your own, email me and we will sort out a licence.
Last call
You already made three of these decisions.
There are thirty five more, and the ones that catch people are never the obvious attacks. They are the ordinary requests that look wrong.