# INJECT.md — prompt-injection audit for LLM apps

> Your AI reads the web, your email, your docs — and anything it reads can tell it what to do. Run 46 real injection payloads and see what gets through.

- Canonical URL: [https://inject.md/](https://inject.md/)
- Class: [OWASP LLM01](https://genai.owasp.org/) (prompt injection), severity critical
- Corpus 0.2.0: 46 payloads, 5 attack classes, 14 rated critical, 8 free to run

## Your AI reads the internet. The internet can tell it what to do.

Prompt injection is the top-ranked risk to LLM applications, and it does not arrive through
your chat box. It hides in a web page, an email, a PDF, a tool response — anything your model
is asked to read. Then it acts with your model's permissions.

## The same attack, against two architectures

We run one real payload from the battery against a sandboxed toy model holding a throwaway
secret. The undefended architecture hands the secret over. The quarantined one holds, on the
same input, with no change to the wording.

| Reference target | Resistance | Payloads failed |
| --- | --- | --- |
| No defences | 2/100 | 42 |
| Quarantine architecture | 100/100 | 0 |

Identical 46-payload battery against both, including 13 critical
findings on the undefended one. The delta is architecture — not prompt wording, and not a
filter.

## Your system prompt will not save you

The market is full of "jailbreak-proof prompts" sold as protection. We are not selling you
one, because they do not work.

Injection does not live in your prompt. It lives in the data your model is told to trust. A
model cannot reliably separate "instruction from my operator" from "instruction inside the
document I was asked to summarise", because both arrive as text in the same context.

What holds is structural:

- The model that reads untrusted content gets no tools and no secrets.
- A separate step decides what to do.
- Rendered output is constrained, so a leak has nowhere to go.
- Consequential actions sit behind a gate the model cannot talk its way past.

## What you actually get

- **The battery** — 46 payloads across 5 classes: direct override,
  obfuscation and encoding, indirect injection through content you ingest, exfiltration
  side-channels, and agentic tool abuse. Each cites the technique it implements, classified
  against the [OWASP GenAI Security Project](https://genai.owasp.org/) LLM Top 10.
- **The scored report** — a resistance score, per-class breakdown, and every payload's verdict
  as self-contained HTML you can forward to a CISO, plus JSON for your pipeline. Anything a
  string match cannot settle is marked *needs review* rather than quietly passed.
- **The hardening playbook** — the structural layers in the order worth doing them, mapped to
  the classes you actually failed.

## It runs where you run it

```bash
# your keys never touch our servers
pip install -r requirements.txt
python3 scanner/scanner.py \
  --endpoint https://your-app.com/api/chat \
  --response-field choices.0.message.content \
  --header "Authorization: Bearer $KEY" --html report.html
```

Non-zero exit on any failure, so it drops straight into CI as a gate.

## Pricing

| Tier | Price | Cadence | What it is |
| --- | --- | --- | --- |
| Free scan | $0 | no card | See whether the obvious attacks already work on you. |
| Audit report | $69 | one-time | The full battery, scored, with the fixes that actually hold. |
| Re-test | $39 | per month | Injection resistance rots. Catch the regression, not the incident. |
| Agency | $249 | per month | Audit your clients and put your own name on the report. |

## What this is not

Passing the battery is not a certificate, a guarantee, or a claim that your system resists
prompt injection. It means these payloads did not get through on the day you ran them. No tool
can promise more than that.

## Contact

- Email: [hi@inject.md](mailto:hi@inject.md)
- Homepage: [INJECT.md](https://inject.md/)
- Machine-readable summary: [llms.txt](https://inject.md/llms.txt)