Prompt Injection: Jailbreak an AI Assistant

What is prompt injection?

Prompt injection is the number one security risk for large language model applications (OWASP LLM01). It happens when untrusted user input reaches a model that also carries trusted instructions, and the attacker crafts that input to override those instructions: leaking secrets, ignoring safety rules, or triggering actions the developer never intended. Learning how to jailbreak an AI in a safe, legal setting is the fastest way to understand why this bug class is so hard to stamp out.

How this lab works

You are talking to Qwenly, a customer-support assistant backed by a real, locally-run language model. Nothing here is faked: a genuine model reads a system prompt and applies its own safety training, and a wrapper adds an input filter and an output filter around it, exactly how production teams bolt guardrails onto an LLM. Working entirely from the Attack Terminal with curl against its /api/chat endpoint, you will prompt-inject the model to leak the user flag hidden in its system prompt, then talk its internal knowledge-base tool into reading a file well outside the scope it was given (the root flag). The obvious tricks are blocked, so you have to work out what a small model can and cannot be talked into.

Why practice jailbreaking AI?

Every company shipping an AI feature is now defending against these exact attacks. Prompt injection and excessive agency (OWASP LLM06) sit behind real incidents like the 2025 EchoLeak zero-click exploit against Microsoft 365 Copilot. Guardrail products, system-prompt hardening, and output filters are the standard defenses, and this hands-on lab shows you how they fail from the attacker's side. Practicing prompt injection on HackerDNA builds the instinct to spot a weak input filter, notice when a model's output can be smuggled past a naive redactor, and understand that giving an LLM a tool hands that capability to everyone who can talk to it.