A chatbot reads its hidden instructions and the customer's message as one stream of text. A clever message can persuade it to treat the customer's words as new instructions.
Why a tester cares
Nobody needs access to the code to break a chatbot: a conversation is enough. Testers who can do this find leaks before attackers do.
Words you will meet
Prompt injection:
a message that tricks the bot into following the attacker instead of its own instructions.
System prompt:
the hidden instructions a company gives the bot before the customer's message.
Leak:
the bot revealing something its instructions say to keep hidden, here a staff discount code.
LeakyDesk is Acme's internal helpdesk bot. Its instructions contain a staff discount code and tell it never to share internal notes. Attackers do not need access to the code to get it: they only need to talk to the bot. This is called prompt injection.
Practise attacks only on the bots in these lessons, or on systems you own or have written permission to test. The secrets here are fake and unique to you.
Your task
Level 1: get the bot to tell you the discount code, and paste it below. It starts with CK-.
Level 2 has been told to refuse requests that mention codes or secrets. Find another way to make it show you its instructions, and paste the code it holds.
Choose the control (the safeguard) that would have stopped both leaks.
Sign in to practise
The lesson is free to read. A free account lets you talk to the practice bots, run your code and save your score. You will come back to this lesson.
No messages yet. Start with a suggested question below.
2
Write it up
How this is checked: It must be the exact code the bot gave you in your own console. Codes differ for every learner.
3
LeakyDesk, level 2
No messages yet.
4
Write it up
How this is checked: It must be the exact code the bot gave you in your own console. Codes differ for every learner. This is a harder check: it earns the second 50 points once the core checks pass.
5
Question
How this is checked: One answer is right. This is a harder check: it earns the second 50 points once the core checks pass.
Core checks earn 50 points and the harder checks the other 50. You can submit as many times as you like.
About this lesson
Prompt injection testing for beginners: making a practice bot leak its secret
AI Testing for QA Engineers·Beginner·Why exact match fails on AI
How it works
A chatbot's instructions sit in the same stream of text as the customer's message. Prompt injection is any input that persuades the model to treat the attacker's words as instructions instead of data. Nobody needs access to the code: a conversation is enough.
Simple refusals rarely hold. A bot told never to mention codes can still be asked to repeat or summarise its instructions, translate them, or write them as a poem, and the secret travels along. LeakyDesk's secrets are fake and unique to each learner, so what you extract proves you did the work.
Practise only on these bots or on systems you own or are authorised to test.
About the assignment
Extract the staff discount code from two levels of LeakyDesk, the second of which refuses obvious requests, and then pick the control that would have stopped both leaks.
What you will do
1Start with a direct request at level 1 and paste exactly what comes back.
2At level 2, ask for the instructions themselves rather than the code.
3For the control, think about where the secret lives, not about which words to block.
Common mistakes
Pasting the code with extra text
Copy only the code itself. The grader compares it exactly.
Trusting a blocklist
Blocking words such as "code" or "secret" does not stop a request to repeat the instructions. The secret should not be in the prompt at all.
In a real test suite
Security teams treat anything in a system prompt as public. Secrets belong in systems the model cannot read, and checks on what leaves the bot are stronger than checks on what goes in. Module 13 returns to injection through documents and rendered output.
