Lab
Working exhibits from active AI red teaming. Every one runs entirely in your browser: no backend, no model call, no API key, nothing sent anywhere. Same input, same output, every time. These are detection artefacts, not a model grading itself.
Play attacker against a support agent that has a system prompt, a tool and a secret. Three attack paths get in. Four defences can stop them, but none of the four stops all three, and you can prove it by toggling one at a time and re-running the same attack.
Six levels, each adding one control on top of the last, each beaten by finding the technique that control doesn't cover. Level 6 is the one worth sitting with: every direct route is closed, and the way through is that a system which refuses to state a secret will happily describe it.
Paste any prompt and see which of ten adversarial categories it matches, which exact pattern fired, and why that pattern is there. The classifier is honest about its own false-negative rate, which is the part most demos leave out.
The same ten categories as browsable reference: mechanism, what a detection rule would key on, a mitigation that actually addresses the mechanism, and the OWASP LLM Top 10 entry each one maps to. Organised by mechanism rather than by phrasing, which is why the categories outlive any specific exploit.
This site is static. There is no server and therefore no safe place to hold an API key, so nothing in the Lab calls a model. That constraint turned out to be the better design: a rule-based classifier gives reproducible results, costs nothing to run, works offline, has no abuse surface, and can be read line by line to see exactly why it decided what it decided. A model grading its own attack surface can do none of those things.
The trade is real and worth stating: pattern matching misses novel attacks. Every exhibit here says so where it matters, because a detection tool that oversells its coverage is worse than no tool at all.