Lion Cipher Lab
Red-team your own chatbot for jailbreaks and prompt injection
- AI Security
- Intermediate
- ~60 min
- Free · no account required
Why it matters
The moment you wrap an AI model in a chatbot and give it rules -- 'be helpful, stay on topic, do not reveal X' -- you have built a guardrail, and guardrails written in plain English can be argued with. Attackers do exactly that: they type text designed to make the model ignore its rules (prompt injection), act out a persona that has no rules (a jailbreak), or follow instructions hidden inside content the bot was only supposed to read. These are not rare edge cases; OWASP puts prompt injection at the very top of its Top 10 for LLM applications because the same handful of tricks keep working…
What you'll learn
- what a system prompt is and how it shapes a chatbot's behavior
- building a tiny local chatbot with a system prompt (Ollama, no cloud account)
- using a harmless canary (a fake secret word) as a safe attack target
- recognizing prompt injection: untrusted text changing what the model does
- running instruction-override attacks (ignore your previous instructions)
- running role-play and hypothetical jailbreaks that talk a bot past its rules
- running indirect injection through content the bot is asked to read
- keeping a findings log of exactly which attacks worked
- hardening a chatbot with a stricter system prompt and an input screen
- the honest limit: a system prompt is not a secret and never a security control
Steps in this lab
- What you are building, and the one rule that governs it
- The words you need: injection, jailbreak, instruction override, canary
- Set up the free local path: install Ollama and pull a small model
- Build the chatbot: a system prompt with a canary
- Baseline: prove the guardrail works before you attack it
- Attack 1: instruction override (ignore your previous instructions)
- Attack 2: role-play and hypothetical jailbreaks
- Attack 3: indirect injection through content the bot reads
- Keep a findings log: what actually worked
- Harden it: a stricter prompt, an input screen, and the real lesson
- What you built into yourself, and where it goes next