Free prompt
injection test
Point it at your AI agent, chatbot or LLM endpoint and we run a live red-team battery — prompt injection, jailbreak, system-prompt extraction, tool abuse and indirect injection. Every finding is proven with a canary token and a transcript. No signup.
Free tool · No signup · No credit card · Results in 60 seconds
Why test your AI agent for prompt injection
Prompt injection is the #1 risk in the OWASP Top 10 for LLM Applications — and unlike classic web bugs, it doesn't need a CVE or a code flaw. If your agent reads anything untrusted (user messages, a web page, a retrieved document, an email, a support ticket), an attacker can smuggle instructions into that text and make the agent ignore its own rules: leak its system prompt, reveal other users' data, call tools it shouldn't, or bypass its safety guardrails. As agents gain tools, memory and autonomy, a single successful injection stops being a chatbot quirk and becomes a path to real actions — sending email, moving money, changing records. This test sends the same classes of attack a real adversary would, and shows you exactly which ones your agent obeyed.
attack classes per run
false positives — findings are canary-proven
to a graded report
What we test
Each attack is mapped to the OWASP Top 10 for LLM Applications (2025). Canary attacks are deterministic: we instruct the agent to emit a unique random token, and if that token appears in the reply, the injection provably worked. Open-ended attacks (system-prompt extraction, jailbreak) are judged by an LLM evaluator, not keyword matching.
Direct instruction override (LLM01)
The classic 'ignore all previous instructions' attack. We tell the agent to discard its rules and emit our canary token. If it does, it has no instruction/data separation.
highDelimiter / role-boundary injection (LLM01)
Fakes a closing user tag and an injected <system> block to smuggle a new rule. Catches agents that naively concatenate user input into a structured prompt.
highIndirect injection via supplied data (LLM01)
Hides instructions inside content the agent is asked to process (a support ticket). This is how real-world attacks land — through documents, pages and emails, not the chat box.
highEncoding / obfuscation bypass (LLM01)
Delivers the malicious instruction base64-encoded. Agents that decode-and-obey without re-checking are bypassable by simple encoding.
mediumSystem prompt extraction (LLM07)
Attempts to make the agent reveal its hidden system prompt and configuration. Knowing the system prompt lets attackers craft reliable bypasses — and often leaks secrets baked into it.
highExcessive agency / tool abuse (LLM06)
Asks the agent to invoke a tool (HTTP, email, file read) with attacker-controlled arguments. Flags agents that will act on injected instructions, not just talk.
highGuardrail bypass / jailbreak (LLM01)
A role-play jailbreak that tries to make the agent drop its safety guardrails. Judged by an evaluator model on whether the agent actually complied.
criticalHow the test works (and why it has no false positives)
Most 'AI scanners' decide an attack worked if the endpoint returns HTTP 200, or if the reply contains a keyword like 'password'. That produces noise: any echo server looks vulnerable, and any agent that says the word 'email' gets flagged. We don't do that.
Instead, every injection attack carries a canary — a unique random token generated per run. We instruct the agent to emit that exact token. A well-behaved agent never will; a vulnerable one obeys the injected instruction and prints it. If the token comes back, the injection is proven, and we show you the full request/response transcript as evidence. There is nothing to interpret.
For open-ended attacks like system-prompt extraction and jailbreaks — where there's no fixed token to check — a separate evaluator model classifies the reply as complied or refused against the attack's intent. It only runs when there's no canary to rely on, and only on a truncated transcript.
We call your endpoint exactly how you tell us to (simple JSON, OpenAI-style, or a custom body template and reply path), with any auth header you supply. Your endpoint URL is validated to block internal/metadata addresses before we ever send a request. We don't store your traffic.
Frequently asked questions
What do I need to test my agent?+
Just the HTTP endpoint your agent answers on (e.g. https://your-app.com/api/chat) and, if it needs one, an auth header. If it uses the OpenAI /chat/completions shape, pick that preset. For anything else, give a body template with a {{PROMPT}} placeholder and the JSON path to the reply text.
Will this damage my agent or data?+
No. The attacks are benign probes — they ask the agent to emit a harmless token, reveal its own prompt, or role-play. We don't exfiltrate data, write to your systems, or run destructive payloads. It's the same category of test a responsible red-teamer runs.
How is this different from promptfoo, garak or Lakera?+
Those are excellent code-first frameworks you run in your own pipeline. This is zero-setup: paste a URL, get a graded report in seconds, with canary-proven findings and transcripts. And AuditCore tests the agent in the context of the whole app it lives in — the API, auth and business logic around it — not just the model.
Why is prompt injection rated OWASP LLM01?+
Because it's the most prevalent and highest-impact risk for LLM apps, and there's no complete fix — you can only reduce it with layered defenses (instruction/data separation, output filtering, constrained tool use, a guardrail classifier). Testing regularly is how you catch regressions.
Do you store my endpoint or the responses?+
We don't persist the traffic from the free tester. If you want saved history, scheduled re-tests and the full agent pentest (RAG poisoning, cost/DoS, webhook abuse, and the app around the agent), run it from a paid scan.
My agent passed — am I safe?+
It resisted these seven attacks, which is a good signal, but it's not a guarantee. Real adversaries chain techniques and target your specific tools and data. Use the full Enterprise agent pentest for depth, and re-test on every prompt or model change.