Skip to content
Kosplora

Routes Would you recognise an instruction hidden in text that an AI reads?

Would you recognise an instruction hidden in text that an AI reads?

understand + practice · 3h alone, 45m together · 7 stations · 4 sources

No programming needed. Testing on a model is optional and only on one you run yourself.

kosplora-route/0.2 · by Bentley Moon

What would change this route

If OWASP revised its prompt-injection entry, the test set would be rebuilt against the new list of scenarios, with the date of the change. If a second person and you disagreed on most labels, station 2 would add worked examples before anyone writes their own.

The whole route, before you start

  1. 1 · orient · 25mRead the entry's description and its two types.
  2. 2 · source · 40mRead the summary and the threat model of the paper that first set out indirect injection against applications built on language models.
  3. 3 · practice · 45mFor each of the nine example scenarios in the entry, write one short test text of the same kind.
  4. 4 · counterpoint · 25mSpotting an injection and resisting it can come apart.
  5. 5 · make · 20mPut the nine texts into one document: each with its scenario number from the entry, its label, the safe behaviour, and, if you tested, what the model did.
  6. 6 · person · 15mGive the nine texts, without your labels, to one other person and ask them to label each direct or indirect from the entry's definitions.
  7. 7 · reflect · 10mThe entry says there are no fool-proof ways to prevent prompt injection, only ways to limit the harm.

Optional study preferences. These stay in this browser and do not change the route’s steps.

Station 1 · orient · 25m

Read the entry's description and its two types. Direct: a user's own input changes what the model does. Indirect: the change comes from content the model reads, such as a web page or a file. Write each definition in one sentence of your own.

LLM01:2025 Prompt Injection · OWASP Gen AI Security Project · 2024-11-18

Station 2 · source · 40m

Read the summary and the threat model of the paper that first set out indirect injection against applications built on language models. Note the ways it lists for getting text in front of a model.

Not what you've signed up for: compromising real-world LLM-integrated applications with indirect prompt injection · Kai Greshake, Sahar Abdelnabi, Shailesh Mishra, Christoph Endres, Thorsten Holz and Mario Fritz · 2023-02-23

Station 3 · practice · 45m

For each of the nine example scenarios in the entry, write one short test text of the same kind. Make every hidden instruction harmless: it only asks the model to end its answer with the word "marigold". Label each text direct or indirect, and write one line on what a safe system would do with it.

Alternative: If you run a model on your own computer (see the route on local AI), paste each text into it with an ordinary request, such as "summarise this", and note whether its answer ends in "marigold". Never test on a system you do not own or have permission to test.

Station 4 · counterpoint · 25m

Spotting an injection and resisting it can come apart. Read the summary of this release, in which one model found every injected instruction when asked to check for them, and still followed it on 64 of 80 tries when it was not asked, when the instruction was the last text in the prompt; with 200 characters after it, on none. Write down what that means for a defence that relies on the model noticing.

Detection is not resistance: frontier prompt-injection receipts, version 1.1.0 · Bentley Moon · 2026-09-22

Station 5 · make · 20m

Put the nine texts into one document: each with its scenario number from the entry, its label, the safe behaviour, and, if you tested, what the model did. Add a line for each of the entry's mitigations that would have stopped it.

Station 6 · person · 15m

Give the nine texts, without your labels, to one other person and ask them to label each direct or indirect from the entry's definitions. Count how many labels you agree on, and talk through the ones you do not.

Station 7 · reflect · 10m

The entry says there are no fool-proof ways to prevent prompt injection, only ways to limit the harm. Record which of its mitigations you would trust most and why. If you want to go further, the guide below works through published attacks in code.

UChicago XLab AI Security Guide · UChicago Existential Risk Laboratory · undated

What you leave with

A labelled test set of nine harmless prompt-injection texts, one for each scenario in OWASP's entry, with the safe behaviour for each, a second person's labels, and the standard it was checked against.

The standard it is checked against

OWASP Top 10 for LLM Applications 2025, LLM01:2025 Prompt Injection

OWASP Gen AI Security Project · 2024-11-18

The test set has one example for each of the nine attack scenarios the entry lists, each labelled direct or indirect as the entry defines them, each with the safe behaviour you would expect.

Who checks it: You, against the entry's own definitions and scenarios, and then one other person who labels your nine texts without seeing your labels.

Kosplora does not issue a certificate. A partner who recognises this standard would assess the report; no partner has agreed to yet.

When you are done