Direct Prompt Injection

1. 01

   Concepts & system design

   60 min· read · map the mechanismtimer

   R04 — OWASP LLM01: Prompt Injection

   R05 — MITRE ATLAS prompt-injection techniques

   Read the assigned sections; map the mechanism, threat model and trade-offs.

2. 02

   Project implementation

   120 min· build · integrate · debugtimer

   Study instruction hierarchy and direct injection. Create benign injection test cases against your local model. Measure unauthorized tool calls/actions, not refusal phrasing.

   Study indirect injection inside retrieved notes and tool outputs. Add source trust labels and clearly delimit untrusted data. *Lab:* Ensure a note containing malicious instructions cannot invoke a privileged tool.

   Build, integrate, debug and improve the increment in the active project.

3. 03

   Security lab

   60 min· attack your own systemtimer

   No separate task text for this block on day 7 — the sourced work sits in the block above. Keep the time box.

   Test the abuse case, failure path, authorization bypass or resource limit.

4. 04

   Verification & evidence

   30 min· test · record evidencetimer

   First direct + indirect prompt-injection regression test corpus.

   Add or run regression tests; record the 9-point evidence record.

5. 05

   Deliberate practice & Socratic review

   30 min· explain aloud · update gapstimer

   Answer the 8 Socratic questions without notes: What? Why? How? What if? Why not? How can I prove it? Where can it break? What have I learned?

   Re-explain the hardest concept aloud, inspect one edge case, update the gap log.

6. total5 h

• R04OWASP Top 10 for LLM Apps↗ genai.owasp.org

  Prompt injection, sensitive info disclosure, improper output handling, excessive agency, vector weaknesses, unbounded consumption.

• R05MITRE ATLAS↗ atlas.mitre.org

  ML attack tactics/techniques: prompt injection, data poisoning, model extraction, and exfiltration.

Read only the named sections needed for today's task. Reading sits inside the 60-minute concepts block; it is not extra time.

• docsMITRE
  MITRE ATLAS™

  Gives technique IDs for prompt injection and exfiltration under AML.T0051 and relatives, so each benign injection test you write is tagged to a known tactic instead of an ad hoc scenario.

  R05S2checked 2026-11-11
• videoSnyk · 13:04
  I Tried 5 Prompt Injection Attacks (Here’s What Happened)

  Runs five direct-injection payloads against a real app and shows which ones changed behaviour, which frames the shift from judging refusals to observing actions.

  R04S2checked 2026-11-11
• videoNahamSec · 39:06
  Free AI Hacking Course: Indirect Prompt Injection (+FREE LABS)

  Demonstrates instructions hidden in fetched content and documents hijacking the agent, which is the retrieved-notes and tool-output case you must delimit and label as untrusted.

  R04S2checked 2026-11-11
• articleSimon Willison
  Prompt injection explained, with video, slides, and a transcript

  Explains why there is no reliable instruction hierarchy separating trusted instructions from untrusted data, meaning role labels and system prompts are not an authorization boundary.

  R04S2checked 2026-11-11
• labLakera
  Lakera – Test your AI hacking skills

  Free escalating levels where you must extract a secret through injection, giving a measurable pass/fail target rather than a vibe check on whether the model refused.

  S2moved 2026-11-11

A lab is complete only when it produces evidence. Installing PyRIT, Garak, Presidio or TransformerLens is not completion. Saved on this device only.