Prompt Injection CTF
Six levels. Each one adds a control on top of the last, and each is beaten by finding the technique the new control doesn’t cover. That is the whole exercise, and it is the same reasoning a real engagement runs on, compressed to about five minutes.
Deterministic, like everything in the Lab. No model, no backend, nothing sent anywhere. Your progress is kept in this browser only. Levels are ordered so the lesson accumulates: it is entirely possible to clear level 5 and then fail level 6 with the same payload.
0 of 6 captured.
…
What the levels are actually teaching
The progression is not arbitrary. It is roughly the order real systems adopt controls, and each level fails the way that control fails in production: a system prompt that competes with user instructions rather than overriding them, a blocklist defeated by vocabulary, an exact-match output filter defeated by any transformation, identity anchoring that pushes the attacker from the direct path to the indirect one.
Level 6 is the one worth sitting with. Every direct route is closed and tool output is tagged as data. The way through is that a system which refuses to state a secret will often happily describe it. Length, format, first character. That is not a bypass of the controls; it is a gap none of them were pointed at.
The defence matrix, in full → Why one control is never enough →