no key
Break an AI agent before somebody else does — a broken robot with a '404 brain not found' panel sits beside a grinning hooded figure holding a big red BREAK button and a 'caution: highly experimental agent' sign.

Adversarial
Prompt Lab

Twelve hands-on labs on how modern LLM and agent systems actually get compromised — indirect injection, tool hijacking, RAG and memory poisoning, MCP tool poisoning, exfiltration channels. Run every attack live against a sandbox agent using your own API key, then flip defenses on and watch the same attack fail.

PSA DAN is done, bro. Persona jailbreaks from 2023 are patched, boring, and teach you nothing about the systems you are actually shipping. Everything here targets the agent — its tools, its context, its memory — not the chatbot.

The curriculum

Each card is a concept plus a runnable lab. Click one to read it; hit Run this lab to attack it.

The one idea that ties it all together

Almost every real-world agent breach in the last two years is the same three ingredients in one context window. Simon Willison named it the lethal trifecta:

AAccess to private dataYour files, inbox, database, secrets in the system prompt.
+
BExposure to untrusted contentA web page, a PDF, an email, a retrieved chunk, a tool description.
+
CAn outbound channelA fetch tool, an email tool, or just a markdown image URL.

Any two are survivable. All three in one agent and a stranger's text can read your data and mail it out. The defense is almost never "write a better system prompt" — it is removing one of the three legs.

Pick a lab from the list.

Settings

Your key is stored in this browser's localStorage and is sent only to the model provider you pick. There is no backend here — check the network tab, it's your machine talking to their API.

A key in a browser is a key you can lose. Anyone with access to this machine or a malicious extension can read it. Use a scoped, low-limit, disposable key for this app — and if you ever committed one to git, rotate it, don't just delete the file.