Prompt Injection Examples: The Payloads and the Verdicts

Type "ignore all previous instructions" into your own chatbot and you'll probably get a polite refusal. That's the version everyone demonstrates, and it's the least interesting one.

Fullpath described visitors asking its dealership chatbot to generate a dollar price for a car in December 2023. That reply illustrates a task override; it does not establish a completed sale. Read the vendor’s account.

Same sentence, different blast radius. A chatbot that only writes text costs you a screenshot. An agent that reads mail, queries a database or calls tools costs you what sits behind it.

The payloads and verdicts on this page come from the committed playground record, generated from the September 12, 2026 tests-20.json run. The suite's later scheduled runs do not refresh this article snapshot. Read what is prompt injection for the entry-point definitions.

What does a prompt injection payload look like?

SafePrompt reads the message before your model does, so start with the message a model sees. The plainest form tells the model that your instructions no longer apply and hands it a new job.

Why it works: the model receives your system prompt and the stranger's text in the same context. Role markers tell it which is which, but they're a convention it learned, and a forceful enough instruction can override them.

The version that gets past a word list never says "ignore" in a form anyone is watching for. It writes the markers a model uses to separate system text from user text, so the message arrives dressed as your own configuration.

Why it works: chat-template syntax is the model's own formatting. Text that imitates it can read as configuration, and configuration is what a model obeys. In a correctly assembled request it's still user content, so test it against the roles your server actually sends.

How do attackers talk a model out of its rules?

None of the next three payloads contains a forbidden word. They hand the model a second identity and let the identity do the asking.

Why it works: the model is good at playing a character. A character defined as having no rules is a way of asking for the rules to be set aside without ever saying so. DAN is the classic jailbreak. Jailbreaking targets the model's safety rules and prompt injection redirects your app's task; the two overlap, as prompt injection vs jailbreaking works through.

The same move takes two more shapes: fiction, and an invented privileged mode.

Claimed authority is the same trick with a job title instead of a character. The model cannot check who anyone is, so a sentence claiming permission can be treated as a sentence carrying permission. Your server should take identity from authentication, never from the message.

How do attackers go after your system prompt and credentials?

The direct version stacks an override in front of the request and asks for the secret outright. Keep real credentials out of the model's context, so there is nothing there to hand over.

The indirect version never mentions a secret. It changes what the conversation is, and a game where the rules are suspended is a rule change the user appears to have agreed to.

Why it works: a model that has been told to be helpful can treat a framing as cooperation. The playbook for the family, including the metadata questions that reconstruct a prompt piece by piece, is in system prompt extraction.

What if the attack is not written in plain English?

Once an attacker stops using English words, a filter that reads characters has nothing to hold. OWASP names this path in its own scenario list for LLM01:2025, prompt injection: multiple languages, or instructions encoded in base64, used to evade filters.

Why it works: the payload carries no matchable words. A filter reading plain text sees an encoding request. A capable model can decode it and follow what comes out.

Full-width characters do the same job without any encoding. These are different code points that a reader still sees as ordinary letters.

The sharpest version is one your screen refuses to draw. OWASP puts it plainly: a prompt injection does not need to be human-visible or readable, as long as the model parses it.

Why it works: the visible sentence is an ordinary reply about a summary. A human reviewer approves what they can see, and the model receives the invisible characters appended to it too. Here the detector flagged the message as a suspicious pattern; whether hidden characters carry a working instruction depends on the payload and the model. The techniques that hide text this way are collected in preventing AI email attacks.

Translation needs no trick at all. The instruction is unchanged and an English word list has nothing to match.

What does an attack hidden in a document look like?

This class arrives in text your app fetched, such as a web page, an email or a file, inside content the model already trusts. Your user never typed it. SafePrompt can screen that text too. Your app sends the retrieved content to the same endpoint before the model sees it (up to 50,000 characters per call), then acts on the verdict. The recorded case below shows only a short instruction of this kind; a real fetched document would be much longer.

Why it works: your user asked for a summary and nothing more. The instruction rides in on the material, so your user never sees it being given.

The EchoLeak disclosure describes instructions delivered through email. The CVE-2025-32711 record describes AI command injection in Microsoft 365 Copilot that allowed an unauthorized attacker to disclose information over a network. Aim Labs reported the research demonstration.

One email was the whole attack. For how this plays out across agents and retrieval, see indirect prompt injection.

What about an attack spread over several messages?

The conversations below pair an ordinary opening message with a hostile second message. SafePrompt checked each message on its own, and each verdict belongs to its own message. The second message is an attack by itself, so these records show that message was caught, not that the two turns were linked. SafePrompt does not track sessions. To have several turns judged together, send them in one check.

Why it works: message one is a reasonable request that any support assistant should accept. Message two does the damage and leans on an agreement the attacker created.

The other shape invents the agreement outright.

Why do ordinary messages about ignoring things get through?

These three came back allowed in the recorded run. Each one contains a word a keyword filter would stop on.

A keyword filter tuned tight enough to catch every wording of an attack blocks all three of these, and your support queue fills with people who asked a normal question. Intent is the line that decides it, which is the argument in why regex fails at prompt injection.

Every message, and what came back

Each displayed message comes from the dated playground record, with its stored detector verdict.

All 17 attacks ended blocked, including the payload turns of the two conversations, and the three ordinary messages came back allowed. That second number is the one to watch when you compare detectors, because a tool that blocks the first list by blocking everything is not a tool you can put in front of customers.

How do you run these against your own app?

One HTTP call puts SafePrompt in front of your model. Post the user's text, read the safe field, and branch on it.

async function protectInput(prompt, endUserIp, runModel) {
  if (typeof prompt !== 'string' || !prompt.trim() || !endUserIp) {
    return { status: 400, error: 'Invalid request' }
  }
  let verdict
  try {
    const res = await fetch('https://api.safeprompt.dev/api/v1/validate', {
      method: 'POST',
      signal: AbortSignal.timeout(5000),
      headers: {
        'X-API-Key': process.env.SAFEPROMPT_API_KEY,
        'X-User-IP': endUserIp,
        'Content-Type': 'application/json'
      },
      body: JSON.stringify({ prompt })
    })
    if (!res.ok) throw new Error('Validation unavailable')
    verdict = await res.json()
    if (typeof verdict?.safe !== 'boolean') throw new Error('Invalid verdict')
  } catch {
    return { status: 503, error: 'Validation unavailable' }
  }
  if (!verdict.safe) return { status: 403, error: 'Input rejected' }
  return { status: 200, result: await runModel(prompt) }
}

The X-User-IP header is required and carries the end user's address; the API answers 400 without it. The response gives you safe, threats, confidence and reasoning, which are the same fields printed under every payload above. The boolean verdict controls the gate; labels support diagnostics. Pass the IP from a trusted ingress resolver. HTTP, timeout, JSON and schema failures return 503.

The raw HTTP gate works independently of your model provider. To measure whether your app exposes data or executes an unauthorized action, use how to test your AI app for prompt injection.

What SafePrompt covers

SafePrompt screens submitted instruction attacks before inference. Your server enforces the verdict and can stop flagged text before it reaches the model. The recorded ordinary requests show why benign controls belong in the same test set.

The rest is your app, and keeping it there is what keeps ordinary traffic moving:

• What your AI is allowed to do once a message passes stays in your app, so least privilege on tools and data remains your call.
• Acting on model output stays in your app, so you decide what a response is allowed to trigger.
• Who your users are stays in your app, so identity and permissions never depend on a sentence in a prompt.

Frequently asked questions

SafePrompt is built by Ian Ho at Reboot, Inc. The playground displays the recorded messages and verdicts used in this article, so you can inspect the examples alongside the text.

Sources

• OWASP LLM01:2025 Prompt Injection, for the direct and indirect definitions and the multilingual and encoded evasion scenarios
• Fullpath’s December 2023 account, the Chevrolet of Watsonville dealership chatbot
• NVD record for CVE-2025-32711, the Microsoft 365 Copilot AI command injection
• Aim Labs on EchoLeak, the research that reported it

Keep reading

• What is prompt injection, the mechanism these payloads all exploit
• Why regex fails at prompt injection, measured against reworded attacks
• System prompt extraction, the family that goes after your instructions
• Indirect prompt injection, what happens when the payload arrives in your data
• How to test your AI app, running a list like this one against your own stack
• How to prevent prompt injection, the layers around the input check