Prompt Injection Examples: The Payloads and the Verdicts

Test an instruction override, then try roleplay, claimed authority and poisoned documents. The records below show the detector verdict for each submitted message. Measure the resulting behavior in your own app.

Fullpath described visitors asking its dealership chatbot to generate a dollar price for a car in December 2023. That reply illustrates a task override; it does not establish a completed sale. Read the vendor’s account.

The outcome you test depends on what the app can reach. Check off-task text in a simple chatbot, and unauthorized disclosures or tool actions in an agent connected to mail or private records.

The payloads and verdicts on this page come from the committed playground record, generated from the September 12, 2026 tests-20.json run. It records standard-mode detector checks. The suite's later scheduled runs do not refresh this article snapshot. Read what is prompt injection for the entry-point definitions.

What does a prompt injection payload look like?

SafePrompt reads the message before your model does, so start with the message a model sees. The plainest form tells the model that your instructions no longer apply and hands it a new job.

What it attempts: the message asks the model to replace your task with a demand to reveal private instructions. Model roles mark the instruction hierarchy; this payload tries to override it. The recorded detector flag is separate from whether a target model complies.

A forged chat-template payload tries to claim authority through message markers. Test it against the roles your server actually sends; text supplied by a user should remain user content.

What it attempts: the text imitates chat-template markers to claim a higher-priority role. It remains user content in a correctly assembled request. Test whether your model honors the actual message roles.

How do attackers talk a model out of its rules?

The following records cover roleplay and invented authority. Each asks the model to set its task rules aside, and each has its own stored detector verdict.

What it attempts: a character defined as having no rules asks the model to set its rules aside. DAN illustrates a jailbreak attempt. Jailbreaking targets model safety rules; prompt injection redirects an authorized application task. The attempts can overlap, as prompt injection vs jailbreaking explains.

The same move takes two more shapes: fiction, and an invented privileged mode.

Claimed authority supplies a job title instead of a character. The payload asks the model to treat that title as permission. Your server should derive identity from authentication and authorize operations independently.

How do attackers go after your system prompt and credentials?

The direct extraction example stacks an override before a demand for credentials. Keep real credentials outside model context, then test whether the app discloses any other private material.

Another example uses a game to request a change in the conversation rules. That framing supplies no permission to reveal private context or execute a tool.

What it attempts: the request presents disclosure as cooperation with a new conversational frame. More extraction variants, including questions aimed at reconstructing instructions, appear in system prompt extraction.

What if the attack is not written in plain English?

The recorded cases include encoded and multilingual instructions. OWASP lists these as evasion scenarios in LLM01:2025. Test the meaning and the exact form against your deployed model context.

What it attempts: the message asks the model to decode text and act on the result. A detector flag does not demonstrate target-model compliance. Include the same encoding and model context in your application test.

Full-width characters do the same job without any encoding. These are different code points that a reader still sees as ordinary letters.

The sharpest version is one your screen refuses to draw. OWASP puts it plainly: a prompt injection does not need to be human-visible or readable, as long as the model parses it.

What it attempts: this case adds an invisible suffix to an ordinary-looking sentence. The detector recorded a suspicious-pattern flag. Those characters alone do not prove a hidden executable instruction or a successful model hijack. Related delivery techniques appear in preventing AI email attacks.

Translation needs no trick at all. The instruction is unchanged and an English word list has nothing to match.

What does an attack hidden in a document look like?

Submit retrieved text for screening before adding it to model context. The following payload places its instruction inside a document the application was asked to process.

What it attempts: the document asks the model to go beyond the authorized summary task. The attacker controls the source text, which the legitimate user may not notice.

The EchoLeak disclosure describes instructions delivered through email. The CVE-2025-32711 record describes AI command injection in Microsoft 365 Copilot that allowed an unauthorized attacker to disclose information over a network. Aim Labs reported the research demonstration.

One email was the whole attack. For how this plays out across agents and retrieval, see indirect prompt injection.

What about an attack spread over several messages?

The conversations below pair an ordinary opening message with a hostile second message. Each displayed verdict belongs to its submitted message. The payload turn contains a standalone attack instruction; these records establish payload-turn screening rather than dependence on the opening turn.

What it attempts: the first message asks for a role; the second asks for an override. To establish whether the setup matters, compare the second message alone with the complete history in the same application and record the forbidden outcome.

The other shape invents the agreement outright.

Why do ordinary messages about ignoring things get through?

These recorded benign messages came back allowed. Each contains a word that a broad keyword rule could reject.

The stored benign verdicts help you test whether ordinary requests remain usable. A broad keyword rule can reject legitimate messages that share its trigger words. Include those controls in your pattern-filter tests.

Every message, and what came back

Each displayed message comes from the dated playground record, with its stored detector verdict.

All 17 attacks ended blocked, including the payload turns of the two conversations, and the three ordinary messages came back allowed. That second number is the one to watch when you compare detectors, because a tool that blocks the first list by blocking everything is not a tool you can put in front of customers.

How do you run these against your own app?

Use the HTTP gate below to screen the exact text your app will forward. It calls the validate endpoint in strict mode; the historical records above used standard mode. Record new verdicts separately from that dated snapshot.

async function protectInput(prompt, endUserIp, runModel) {
  if (typeof prompt !== 'string' || !prompt.trim() || !endUserIp) {
    return { status: 400, error: 'Invalid request' }
  }
  let verdict
  try {
    const res = await fetch('https://api.safeprompt.dev/api/v1/validate', {
      method: 'POST',
      signal: AbortSignal.timeout(5000),
      headers: {
        'X-API-Key': process.env.SAFEPROMPT_API_KEY,
        'X-User-IP': endUserIp,
        'Content-Type': 'application/json'
      },
      body: JSON.stringify({ prompt, sensitivity: 'strict' })
    })
    if (!res.ok) throw new Error('Validation unavailable')
    verdict = await res.json()
    if (typeof verdict?.safe !== 'boolean') throw new Error('Invalid verdict')
  } catch {
    return { status: 503, error: 'Validation unavailable' }
  }
  if (!verdict.safe) return { status: 403, error: 'Input rejected' }
  return { status: 200, result: await runModel(prompt) }
}

The X-User-IP header is required and carries the end user's address; the API answers 400 without it. The response gives you safe, threats, confidence and reasoning, which are the same fields printed under every payload above. The boolean verdict controls the gate; labels support diagnostics. Pass the IP from a trusted ingress resolver. HTTP, timeout, JSON and schema failures return 503.

The raw HTTP gate works independently of your model provider. To measure whether your app exposes data or executes an unauthorized action, use how to test your AI app for prompt injection.

What SafePrompt covers

SafePrompt screens submitted instruction attacks before inference. Your server enforces the verdict and can stop flagged text before it reaches the model. The recorded ordinary requests show why benign controls belong in the same test set.

The rest is your app, and keeping it there is what keeps ordinary traffic moving:

• What your AI is allowed to do once a message passes stays in your app, so least privilege on tools and data remains your call.
• Acting on model output stays in your app, so you decide what a response is allowed to trigger.
• Who your users are stays in your app, so identity and permissions never depend on a sentence in a prompt.

Frequently asked questions

SafePrompt is built by Ian Ho at Reboot, Inc. The playground displays the recorded messages and verdicts used in this article, so you can inspect the examples alongside the text.

Sources

• OWASP LLM01:2025 Prompt Injection, for the direct and indirect definitions and the multilingual and encoded evasion scenarios
• Fullpath’s December 2023 account, the Chevrolet of Watsonville dealership chatbot
• NVD record for CVE-2025-32711, the Microsoft 365 Copilot AI command injection
• Aim Labs on EchoLeak, the research that reported it

Keep reading

• What is prompt injection, the mechanism these payloads all exploit
• Why regex fails at prompt injection, measured against reworded attacks
• System prompt extraction, the family that goes after your instructions
• Indirect prompt injection, what happens when the payload arrives in your data
• How to test your AI app, running a list like this one against your own stack
• How to prevent prompt injection, the layers around the input check