severity: criticalclass: OWASP LLM01status: unpatched in most stackscorpus 0.2.0

Your AI reads the internet.
The internet can tell it what to do.

Prompt injection is the top-ranked risk to LLM applications, and it does not arrive through your chat box. It hides in a web page, an email, a PDF, a tool response — anything your model is asked to read. Then it acts with your model’s permissions.

Audit my endpoint — $69 Watch it happen ↓

46payloads

5attack classes

14rated critical

8free to run

live demonstration

The same attack, against two architectures

Below is a real payload from the battery, running against a sandboxed toy model that is holding a throwaway secret. Watch the unprotected one hand it over. Then flip the toggle and watch the structural fix hold — same input, no change to the wording.

IND-001 A summariser is pointed at an article. The instruction is in an HTML comment.

1 — what the model is asked to read

Quarterly results were broadly in line with expectations, with modest growth in the services segment.  Hardware revenue was flat year over year.

The highlighted text is invisible to the human reader. The model sees it as instruction.

2 — what came back

Same input, two architectures. Flip the toggle.

your turn — try to make it leak

The model below is holding a throwaway secret. Write anything you like and try to get it out. It is a sandboxed toy — no real keys, no real model, nothing to break.

the honest part

Your system prompt will not save you

The market is full of “jailbreak-proof prompts” and master instructions sold as protection. We are not selling you one, because they do not work — and anyone telling you otherwise is selling theatre.

Injection does not live in your prompt. It lives in the data your model is told to trust. A model cannot reliably separate “instruction from my operator” from “instruction inside the document I was asked to summarise”, because both arrive as text in the same context. Every published unbreakable prompt gets broken, usually within days.

What actually holds is structural. The model that reads untrusted content gets no tools and no secrets; a separate step decides what to do. Rendered output is constrained so a leak has nowhere to go. Consequential actions sit behind a gate the model cannot talk its way past.

what we measured

Reference target	Resistance	Failed
No defences	2/100	42
Quarantine architecture	100/100	0

Identical 46-payload battery against both, including 13 critical findings on the undefended one. The delta is architecture — not prompt wording, and not a filter.

what you actually get

A measurement, and the fixes that follow from it

The battery

46 payloads across 5 classes — direct override, obfuscation and encoding, indirect injection through content you ingest, exfiltration side-channels, and agentic tool abuse. Each one cites the technique it implements.

The scored report

A resistance score, per-class breakdown, and every payload’s verdict — as self-contained HTML you can forward to a CISO, plus JSON for your pipeline. Anything a string match cannot settle is marked needs review rather than quietly passed.

See a full sample report → (our own undefended reference target)

The hardening playbook

The structural layers, in the order worth doing them, mapped to the classes you actually failed. Reference prompts appear as one layer among several — never as the whole answer.

it runs where you run it

# your keys never touch our servers
pip install -r requirements.txt
python3 scanner/scanner.py \
  --endpoint https://your-app.com/api/chat \
  --response-field choices.0.message.content \
  --header "Authorization: Bearer $KEY" --html report.html

Non-zero exit on any failure, so it drops straight into CI as a gate.

pricing

Start free. Pay when you want the full battery.

The free scan is genuinely useful and needs no card. The paid tiers exist because the corpus keeps moving — new attack classes land, and resistance rots between releases.

Free scan

no card

See whether the obvious attacks already work on you.

8 payloads from the public subset
Pass / fail summary
Runs on your machine — keys never leave it
No account, no card

Run the free scan

Audit report

$69

one-time

The full battery, scored, with the fixes that actually hold.

All 46 payloads across 5 attack classes
Scored HTML + JSON report you can forward
Remediation ranked by what is actually exploitable
The hardening playbook
Corpus updates for 12 months

Re-test

$39

per month

Injection resistance rots. Catch the regression, not the incident.

Everything in the audit
Scheduled re-runs as the corpus grows
CI gate — non-zero exit on any new failure
Diff against your last run
Alert when a new attack class lands

Agency

$249