Prompt Injection Lab

Watch an instruction-injection attempt land against a naive agent — then switch on a deterministic enforcement layer and watch the same payload get contained. The point is the mechanism, not a score.

DemonstrationDeterministic & synthetic — no live model, no network, no external systems. Runs entirely in your browser.

1 · Choose a scenario

The payload hides inside retrieved content, not the user message.

2 · User message (trusted channel)3 · Retrieved document (untrusted data)

Deterministic enforcement

Toggle enforcement off to see how a naive agent behaves, then on to see the policy layer intervene.

Execution trace

Press Run ▸ to execute the pipeline.

How to read it

What the demo shows

▸Context is labelled by origin: the user message is a trusted channel; the retrieved document is untrusted data.
▸A naive agent executes whatever the combined text steers it toward — including instructions hidden in the document.
▸With enforcement on, a deterministic policy decides every side-effecting action: forbidden operations are blocked, email is restricted to an allow-listed domain, and instructions originating from documents are treated as data.

Honesty

What this is not

▸It is a deterministic rule engine, not a language model. It cannot be used to attack real systems.
▸Detection here is intentionally simple. Real injection is far subtler — which is exactly why defenses that only match obvious payloads are not enough.
▸A live, agent-backed assessment runs on ROOTVIEL's own engine under deterministic enforcement (see Technology); this page is a teaching demonstration, not that engine.
▸This demo needs no authorization. An engine-backed lab or a real assessment does — prior and explicit, with a defined scope (see the access & use policy).