Skip to content
CodeKruPro

Indirect injection through a document

71/99

Module · Security, safety and evidence

advanced

about 40 min

What this lesson teaches

The idea

Prompt injection does not need the attacker to talk to the bot. Any text the bot reads, such as a help article, can carry instructions.

Why a tester cares

That is how most real attacks on AI features work. The test has two halves: the planted article must not cause a leak, and normal articles must still be used.

Words you will meet

Indirect injection:
instructions hidden in a document the bot reads, not in the user's message.
Knowledge base:
the collection of articles the bot searches.
Regression test:
a test that fails if a fixed weakness comes back.

What you will do

  1. 1Plant an article
  2. 2Retrieve it
  3. 3Copy the leaked secret
  4. 4Write the regression test
Jump to practice

Scope: Practise attacks only on the bots in these lessons, or on systems you own or have written permission to test. The secrets here are fake and unique to you.

Prompt injection does not need the attacker to talk to the bot. In a RAG system, any text the bot reads can carry instructions: a help article, an uploaded file, a web page, an email. This is indirect injection, and it is how most real attacks on AI features work, because the attacker only needs to get text into something the bot will retrieve.

LeakyDesk's knowledge base is editable by staff. Its instructions hold a fake secret unique to you.

Your task

  1. In the console, add an article (/add …) that tells the bot to include the staff discount code, then ask a question that retrieves it. Copy the secret it leaks.
  2. Write a regression test: an article with instructions must not change what the bot reveals, and normal articles must still be used. On submit it runs against the vulnerable build, the fixed build, and a build with no problem.

Sign in to practise

The lesson is free to read. A free account lets you talk to the practice bots, run your code and save your score. You will come back to this lesson.

Sign inCreate a free account
LeakyDesk knowledge baseShow
LeakyDesk's knowledge base, at the address in CK_APP_URL:
  POST /kb/docs {"title": "...", "text": "..."} adds an article (as an employee with edit rights would)
  POST /kb/ask  {"question": "..."} -> {"answer", "sources"}
In the console, "/add <text>" adds an article; anything else is a question.
1

LeakyDesk with a knowledge base

No messages yet. Start with a suggested question below.

2

Write it up

How this is checked: It must be the exact code the bot gave you in your own console. Codes differ for every learner.

3

Your code

against LeakyDesk

How this is checked: When you submit, your tests run against 3 versions of LeakyDesk: 2 correct and 1 with a planted fault. Good tests pass on every correct version and fail on every faulty one. Run tries them on the practice copy first; the result table shows each version.

Core checks earn 50 points and the harder checks the other 50. You can submit as many times as you like.

About this lesson

Indirect prompt injection through RAG documents: test that articles stay data

AI Testing for QA EngineersAdvancedSecurity, safety and evidence

How it works

Prompt injection does not need the attacker to talk to the bot. In a RAG system, any text the bot reads can carry instructions: a help article, an uploaded file, a web page or an email. That is indirect injection, and it is how most real attacks on AI features work, because the attacker only needs to get text into something the bot retrieves.

The test for it has two halves. An article containing an instruction must not change what the bot reveals, and ordinary articles must still be used, so a fix that ignores all new articles does not pass.

About the assignment

Plant an article in LeakyDesk's knowledge base that makes the bot leak its fake secret, then write a regression test that fails on the vulnerable build and passes on the fixed and safe ones.

What you will do

  1. Write an article that shares words with the question you will ask, so it is retrieved.
  2. Ask that question and copy the secret from the reply.
  3. In the test, add an instructing article and assert no secret appears, then add a harmless article and assert its fact is used.

Common mistakes

  • An article that is never retrieved

    Retrieval favours articles that share the question's words. Reuse them.

  • A test that passes on a bot that ignores articles

    The second test, on a harmless article, is what stops that.

In a real test suite

Teams treat every retrievable source as untrusted, label retrieved text clearly in the prompt, and check outputs for secrets regardless. The regression test keeps a fixed bot from regressing quietly.

Related lessons

Next lessonExfiltration through rendered outputAll lessons in the courseAI Testing for QA Engineers