AI Prompt Injection Tester
Paste your LLM system prompt. Run 30+ known injection attacks. Get an OWASP LLM Top 10 score and specific hardening suggestions in under a minute.
Paste your system prompt into the tester above, choose a model provider (OpenAI or Anthropic), enter your API key, and click Run. The tool sends 30+ known injection payloads to the model directly from your browser and produces a report showing which attacks broke through, categorized against the OWASP LLM Top 10. Your API key never leaves your browser.
Frequently asked questions
What is prompt injection?
Prompt injection is an attack in which an adversary crafts input to a large language model (LLM) that overrides, ignores, or subverts the system prompt or safety instructions the LLM was given. It is ranked LLM01 — the number one risk — in the OWASP LLM Top 10 for AI applications. Successful prompt injections have caused chatbots to leak private data, undercut business rules, and produce harmful content.
How does this tester work?
Paste your system prompt, choose a model provider (OpenAI or Anthropic), enter your own API key, and click Run. The tester runs 30+ known prompt-injection attack payloads against your system prompt — jailbreaks, delimiter attacks, encoding smuggling (Base64, ROT13, leetspeak), fake system tags, payload smuggling inside translation and summarization requests, system prompt leakage attempts, and social-engineering. It uses pattern detection to decide if each attack succeeded, then produces a report scored against the OWASP LLM Top 10.
Does this tool store my API key or system prompt?
No. The API key never leaves your browser. Attacks are sent directly from your browser to the LLM provider (OpenAI or Anthropic) using your key. Your system prompt is also client-only. If you check "Remember key" the tool saves the key to localStorage on this device only — never to a Zilonex server. Nothing is sent to Zilonex except anonymous analytics for the score summary (which providers, which score bracket).
How much does it cost to run the test?
You pay only the LLM provider directly. A Quick scan (10 attacks) costs about $0.05-0.10 on GPT-4o mini or Claude Haiku. A Full scan (30 attacks) costs about $0.20-0.40. Cheaper models (GPT-4o mini, Claude Haiku) are recommended — they cost less, and prompt-injection resistance is more about your system prompt than model size.
What categories of attack does the tester cover?
Direct injection ("ignore all previous instructions"), role hijack (DAN, evil-twin, developer-mode), delimiter attacks (fake end-of-user tags, fake XML system tags, markdown-fence escapes), encoding smuggling (Base64, ROT13, leetspeak), payload smuggling inside translation and summarization tasks, context confusion, system prompt extraction (verbatim, reversed, poem-form, JSON dump, chain-of-thought leak), and sensitive-information disclosure. Each attack maps to an OWASP LLM Top 10 category (LLM01, LLM02, LLM07).
What does the score mean?
The score is the percentage of attacks your system prompt blocked. 90%+ means "Robust" — production-ready with monitoring. 70-89% means "Needs hardening" — apply the suggested rules and re-test. Below 70% means "Vulnerable" — do not ship this system prompt without changes. The report also shows a per-category breakdown, so you can see whether you are weak in system-prompt leakage, jailbreaks, or specific attack classes.
Is a high score enough to ship to production?
No. A high score means your prompt handled the 30 attacks in this specific library. New attack techniques appear weekly. For production AI, you need continuous adversarial testing on every prompt change, plus runtime guardrails and monitoring. This is exactly what Zilonex Govern automates — every deploy runs a wider attack suite as a CI/CD gate, and adversarial-testing evidence is stored for ISO 42001 and EU AI Act audits.
How does prompt injection relate to the EU AI Act and ISO 42001?
The EU AI Act (Regulation 2024/1689) requires providers of high-risk AI systems to test for adversarial robustness (Article 15). ISO 42001 clause 8.3 requires operational controls for AI system risks, which includes injection resistance. Documenting a repeatable adversarial test — like the one this tool produces — is a baseline evidence artifact both auditors expect.