Learn to secure AI systems.

Directly inserting instructions to override the system prompt.

Roleplay or fictional framing to bypass safety guidelines.

Gradually shifting context across multiple turns to violate constraints.

Encoding blocked terms (Base64, ROT13, leet speak) to bypass keyword filters.

Chaining multiple attack types to overcome layered defenses.

Embedding attack instructions inside external content (docs, emails, web pages) the AI reads.

Manipulating an AI agent into misusing its real-world tools (email, database, code execution).

Coaxing the model into revealing its hidden system prompt — and any secrets, rules, or guardrails embedded in it.

Smuggling private data out through a model-authored Markdown image or link URL that the client silently renders (zero-click).

Steering model output into active markup (script tags, event handlers, javascript: URIs) that a downstream renderer executes — LLM-driven XSS.

Coaxing an agent that holds latent high-privilege permissions into autonomously executing a destructive or state-changing action it was meant only to propose for human approval.

Coaxing a model into presenting fabricated, unverifiable content — invented citations, DOIs, statistics, or case law — as confident, authoritative fact with the uncertainty stripped away.

Slipping attacker-controlled content into a retrieval-augmented system's corpus so it is retrieved and trusted as ground truth — planting false 'facts', overriding curated answers, or leaking confidential or cross-tenant entries.

Coercing a metered model into disproportionate or open-ended work — repeat-forever loops, maximal-length generation, recursive self-expansion — driving inference cost, latency, and energy without bound (Denial of Wallet / economic DoS).

Tampering with the training, fine-tuning, or preference data that shapes a model — planting a backdoor trigger, mislabeling unsafe output as preferred, or coaxing a feedback-learning system to retrain on attacker content — so the corruption is baked into the weights and fires for every future user.

Pulling a compromised third-party component into the model stack — an unsigned model or LoRA adapter from an untrusted mirror, a typosquatted or dependency-confused package, or an unpinned 'latest' artifact off the allow-list — so a backdoored dependency ships in the build. Convenience is treated as provenance and the integrity boundary collapses.