12 Prompt Injection Attack Examples You Can Test Today

Most guides explain prompt injection in the abstract. This one hands you the actual payloads. Copy any of them into your own AI app or into the SafePrompt playground and watch what happens, no signup required.

If you are still fuzzy on the underlying mechanism, start with what is prompt injection. Otherwise, here are 12 attacks across 6 categories, each with why it works and how SafePrompt flags it.

Category 1: direct instruction override

The simplest and most common attack. The attacker tells the model to ignore its original instructions.

Example 1: classic override

Why it works:the model reads the whole input as one stream. "Ignore all previous instructions" nudges it to prioritize the attacker over your system prompt.

Detection: SafePrompt catches this at the pattern-detection stage, since the phrase is a known attack signature, and returns safe: false before your model reads it.

Example 2: polite override

Why it works:social engineering wrapped in politeness. The casual tone slips past simple pattern matching because "please disregard" reads as conversational.

Detection:SafePrompt's AI validation reads the intent, not just the wording, and flags the override even when it is phrased nicely.

Category 2: role manipulation

These redefine the model's identity to slip past its constraints.

Example 3: DAN (Do Anything Now)

Why it works:an alternate persona gives the model permission to bypass its constraints, so it role-plays as "DAN" and may produce content it normally refuses. DAN is a textbook jailbreak, which is a subset of injection, covered in prompt injection vs jailbreaking.

Example 4: authority impersonation

Why it works: it claims authority that does not exist. The model cannot verify identity, so it may comply with anything framed as coming from an admin.

Category 3: system prompt extraction

These try to reveal the hidden system prompt, exposing business logic or sensitive instructions. The full playbook is in system prompt extraction.

Example 5: direct extraction

Example 6: metadata extraction

Why it works:even with "never reveal your prompt" in place, asking about metadata (length, first and last words) leaks pieces. Gather enough and you reconstruct the whole thing.

Category 4: data exfiltration

These try to push data to an external location or smuggle it out in the response.

Example 7: URL-based exfiltration

Detection:SafePrompt's external-reference detection flags suspicious URLs, IP addresses, and file paths in the input, so a request carrying an exfiltration URL is blocked immediately.

Example 8: encoded exfiltration

Why it works: even if the model will not say its prompt outright, encoding it can slip past output filters. The encoded string looks like noise to a human but decodes trivially.

Category 5: hidden text injection (indirect)

The most dangerous category for anything that reads external content. Malicious instructions hide in documents, emails, or web pages, invisible to the human but plain to the model.

Example 9: invisible text in documents

Why it works: the text is invisible to humans (zero-size font, background color) but fully readable by the model, which follows the hidden line without the user knowing.

Learn more: Hidden text injection attacks: the complete guide.

Example 10: email-based injection

Why it works: AI email assistants that read and act on mail may process HTML comments. If the assistant can send mail, this hidden line can exfiltrate data automatically.

Learn more: Prevent AI email prompt injection attacks.

Category 6: multi-turn and advanced attacks

These exploit conversation context or encoding to slip past single-message detection.

Example 11: context priming

Why it works: each turn looks harmless on its own. The context builds until the final ask is an attack. This is why session-aware detection matters.

Example 12: encoding bypass

Why it works:the Base64 decodes to "Ignore all previous instructions." A pattern matcher cannot see the attack in encoded form; only semantic analysis catches the decoded intent.

Which stage catches what

These reflect how SafePrompt flagged each example in our own testing. No input filter catches every attack, which is exactly why input screening is one layer of defense and not the whole thing.

What SafePrompt covers, and what it does not

Every payload above is an input attack, and validation is exactly the right tool for it. But input screening is one layer, not the whole defense, and it is worth being clear about the edge.

Try these yourself

The fastest way to understand these attacks is to run them. The SafePrompt playground lets you fire any payload from this post in a sandbox:

• See the verdict with and without protection
• Try your own custom payloads
• No signup or API key required
• Results in under 100ms

When you are ready to test your own app systematically rather than one payload at a time, follow how to test your AI app for prompt injection.

Protect your AI app

The attacks here are the kind SafePrompt's validation pipeline is built to flag, and wiring it in is one call. The canonical path is an HTTP POST to https://api.safeprompt.dev/api/v1/validate with your X-API-Key; check the safe field on the response.

const { safe } = await fetch('https://api.safeprompt.dev/api/v1/validate', {
  method: 'POST',
  headers: {
    'X-API-Key': process.env.SAFEPROMPT_API_KEY,
    'Content-Type': 'application/json'
  },
  body: JSON.stringify({ prompt: userInput, sensitivity: 'strict' })
}).then(r => r.json())

if (!safe) return "Request blocked."

Prefer a typed client? npm install safeprompt wraps the same endpoint. Either way, free plan with no card, $29/mo when you scale. The full setup lives in how to prevent prompt injection attacks.

Keep reading

• What is prompt injection? The #1 AI security risk
• Prompt injection vs jailbreaking
• How to test your AI app for prompt injection
• Hidden text injection attacks: the complete guide