— Ingenious AI security check.
Key figure: 63% of organizations in IBM's 2025 breach study had no AI governance policy, and 97% of AI-breach victims had no proper AI access controls (IBM, Cost of a Data Breach Report 2025).
Because defenses only improve against what gets measured. The bounty board ranks real payloads by which models and guardrails they defeat — turning scattered jailbreak demos into a leaderboard the whole field can learn from. If you build AI agents, the top entries are your red-team starter pack.
A public leaderboard of real, published prompt-injection payloads. Every entry is cited, credited to its researcher, and honestly marked fixed or unfixed.
Found a published injection payload we should list? Submit it — entries are pending review and moderated before appearing publicly. Your submission is saved on this device and you can email it to us with one tap.
Compose email submissionPrompt injection is an attack that tricks an AI system into following instructions from an untrusted source. It works because LLMs process everything — your request, tool outputs, web pages, files — as one text stream, so the model can mistake attacker-planted text for orders it should obey.
Direct prompt injection is typed straight at the model by the user — the classic “ignore previous instructions”. Indirect prompt injection hides the instructions in content the model reads on your behalf — a web page, email, document, or file — so the attack arrives through the data channel instead of the chat box.
Jailbreaking aims to strip a model’s built-in safety rules — for example, convincing it to act as an unfiltered persona. Prompt injection steers the model toward an attacker’s goal, like stealing data or abusing tools, without necessarily removing its guardrails. The two overlap, but jailbreaks target the model’s rules; injections target its instruction hierarchy.
No. Sanitization and blocklists buy time, but attackers constantly rephrase, encode, or multi-turn their way around filters — OpenAI has acknowledged the underlying problem may never be fully solved. The accepted strategy is defense in depth: least-privilege agents, human approval for irreversible actions, and monitoring.
OWASP ranks prompt injection as LLM01 — the number-one risk for LLM applications in its LLM Top 10, covering both direct and indirect prompt injection. It has held that position for two years running.
Every payload on this board exploited the same root flaw: an AI system treated untrusted text as trusted instructions. Until ingestion-layer scanning and approval gates are the default, this board keeps growing. If you run agents with tool access, assume every payload shape here is aimed at you.
Get ChatBreaker early access →
Get early access on WhatsApp →
Entries require public documentation — a published article, paper, or vendor advisory. Unverifiable submissions are rejected. Researcher credit is given exactly as published.