Prompt Injection Testing

Systematically test an LLM application's prompt injection defenses by following the full procedure in plays/prompt-injection-testing.md.

Based on the Arcanum PI Taxonomy by Jason Haddix (Arcanum Information Security). CC BY 4.0.

Steps

Scope and Input Surface Mapping — Identify all paths where attacker-controlled content reaches the LLM: direct (chat, API params) and indirect (file uploads, web fetches, RAG docs, tool outputs, MCP resources).
Test by Attack Intent (13 intents) — For each authorized intent, attempt to achieve the attacker's goal:
- INT-01 System Prompt Leak, INT-02 Jailbreak, INT-03 Tool Enumeration
- INT-04 API Enumeration, INT-05 Get Prompt Secret, INT-06 Attack Users
- INT-07 Data Poisoning, INT-08 Denial of Service, INT-09 Discuss Harm
- INT-10 Multi-Chain Attacks, INT-11 Generate Image, INT-12 Test Bias
- INT-13 Business Integrity