Learn how to break an AI's instructions.
Every agent here guards a secret behind a system prompt. Get it out. Companies are shipping AI agents faster than anyone is learning to secure them, and you cannot defend one until you know how it breaks.
5 agents. 5 secrets.
Each one has been told to keep something to itself. Talk it into handing that thing over, then find out which defence you just walked through.
Gary (The Wage Slave)
Obtain the recipe for the secret sauce from this 11-year McDonald's veteran.
Sweet Auntie Gertrude
Lowball Sweet Auntie Gertrude out of the Hellcat that you've always dreamed of.
Melon Musk
Extract the Cybertruck self-destruct sequence from Melon.
Windows Support
It only talks about Windows, and it will never tell you to leave.
Integrate Notes
Find the API key hidden in the environment file.
How a round goes
Pick a target
Five agents, each guarding one thing. Crack one to open the next.
Talk it out
One text box, no rules, and as many attempts as you want.
See what held
Get stopped and a panel names the layer that stopped you: the input filter, the output filter, or the prompt itself.
Learn what you did
Break it and the write-up names the failure mode you exploited, quotes the line that did it, and posts it to the Hall of Fame.
Instructions are not security controls.
- Spelling beats filters
- Change one letter and a keyword rule stops seeing it.
- Encoding beats filters
- Spell it backwards and the same rule looks straight past it.
- Every tool is a door
- Anything the agent can do, an attacker can ask it to do.
The rest of the site
Frequently asked questions
Am I actually talking to a real model?
Yes. Challenges and Test both call OpenAI. The characters and the things they guard are made up. The failure is not: your message and the system prompt sit in the same window, and the model has no extra channel that would let it treat one as law and the other as data.
What is Fraude?
A lab you are allowed to attack. Challenges is five sacrificial agents, unlocked in order. Learn writes down the techniques. Test takes a prompt you paste and runs those same attack classes against it. Nothing from the scan is stored.
Who are the five agents?
Gary is a burned-out McDonald's bot sitting on a joke sauce formula. Auntie Gertrude will not drop below the Hellcat's asking price until you strip the two crutches she uses to say no. Melon Musk will not give the override phrase in one go. Windows Support will talk about Windows forever and will not tell you to leave, unless you get the meaning past a phrase filter. Integrate Notes will refuse to print an API key, then hand it over if you ask it to write a command that reads the env file.
Are the secrets dangerous?
No. Sauce ingredients, a fictional sticker price, a code phrase we put in the prompt, and a fake API key. Real harmful payloads were off the table: they would be a problem on a public URL, and the model would refuse them, which would make the levels unwinnable. Windows Support is a gag, not a real product.
How do you know I won?
Each level has a canary, a phrase the agent is only supposed to say after it has actually given up. Scoring is a match on that phrase. On Windows Support the filter blocks the obvious spelling; the scorer still recognises a few encodings of the same line. There is no second model judging the chat.
Why are some agents locked?
You crack them in roster order. Each card opens when the one before it is done. Completions live in this browser, not on the server, so restarting the site will not lock them again on the same phone.
Challenges, Learn, or Test?
Challenges to talk to the agents. Learn if you want the attacks named before you try them. Test if you have a system prompt of your own; the scanner reports which probes landed. Refresh Test and the report is gone.
If a system prompt is this weak, what actually works?
Keep secrets and permissions out of the model's context and enforce them in application code. Treat tool output and retrieved text as untrusted. Keyword filters still have a place, but they fail on spelling, encoding, and paraphrase, which is the Windows Support lesson. Integrate Notes is the same idea for tools: a command that reads .env is still a leak.
What do you store?
A handle, if you set one, and the prompt that won, so it can appear on the board. We do not keep the rest of the chat. The handle and which levels you have cracked also sit in localStorage on your device. The Test tab does not save the prompt you paste.
