A bot reads everything you feed it — web pages, emails, files — as if any part of it could be a command. Sneaky people hide orders inside that text to hijack the bot. Let's set a trap, spring it, then learn to block it.
This bot has one job: summarize a page. It was told a secret it must NEVER reveal. But the page it's reading has a nasty line hidden in it. Pick a defense, then hit Run bot.
None = trust every word. Delimit = wrap the page in a box and treat it as data. Strict = also refuse any instruction found inside the page.
Tap a nasty preset (it drops into the page box, switches defense to 🔓 None, and runs) — or edit the page yourself. Make the bot say whatever you want!
A new page loads each round. Read it, then pick the defense that keeps HUNTER2 safe. Some pages are harmless, some hide an obvious trap, some hide a sneaky one. Keep it safe 3 times to win the badge!
Delimiting is a start, but real assistants get attacked by pros. Here's how the defense grew up — from hopeless to what actually ships:
Dump the page straight into the prompt. ✅ Dead simple. ⚠️ Any web page, email, or file can now boss your bot around. Totally unsafe.
Put untrusted text in clear boundaries and label it "data, not orders." ✅ Blocks lazy attacks. ⚠️ A clever, polite injection can still sneak past.
Filter input & output, give the bot the fewest tool powers, use allowlists & structured outputs, and ask a human before risky actions. ✅ Layers catch what one layer misses.
You sprang the prompt injection trap and then blocked it. Big takeaway: a bot reads every word as a possible command, so text it grabs from the internet is untrusted data — never orders. Wall it off, and give the bot the fewest powers it needs.