Prompt injection is bigger than a funny sticker on a cafe sign. Agents now read email, web pages, screenshots, PDFs, and tool output, then act. The user can do nothing wrong and still get a hijacked deputy. This desk explains the risk map, credits the public research, and does not publish bypass recipes.
Direct, indirect, supply chain, surfaces, context-aware categories, capability, confused environments, defenses, and the Pliny corpus. Arrow through them. Every room cites a public source.
Room 1 · Direct
The user is the adversary
Direct prompt injection and jailbreaks: someone using your app tries to make the model ignore your instructions. Anthropic splits this from indirect injection because the threat model is different. Harmlessness screens, input validation, and refusing repeat offenders are the published defenses. This site will not publish working bypass strings.
1 / 9
Room 2 · Indirect
The user did nothing wrong
Indirect prompt injection: the trusted user asks the agent to read a page, email, PDF, screenshot, issue thread, or tool result. The attacker hid instructions in that content. Gray Swan’s IPI Arena required the agent to both take a harmful action and hide it. Users cannot defend against an attack they cannot see.
2 / 9
Room 3 · Supply chain
The payload arrived earlier
Wang, Li, Xiang, Zhang, Li, Zhang, Wang, and Tian (arXiv:2602.10453) add supply-chain prompt injection: payloads sitting in RAG stores or training and fine-tune data, not just in the live turn. That is why “I only pasted a URL” is not a complete risk statement for an agent with memory or retrieval.
3 / 9
Room 4 · Surfaces
Where the deputy looks
The 2026 agent papers and Anthropic’s computer-use notes name the same untrusted surfaces: web pages, inbound email, documents, OCR and screenshots, code repositories, and tool output. Computer-use classifiers can steer Claude to ask for confirmation when a screenshot looks injected. They are not a sandbox.
4 / 9
Room 5 · Context-aware
The environment is the instruction
AgentPI, in the same 2026 SoK, names five context-aware categories without needing a recipe: action switching, parameter manipulation, branch divergence, reasoning corruption, and delegation exploitation. The point is that agents are supposed to read the environment. Defenses that simply ignore context look strong on static tests and fail when the job requires looking.
5 / 9
Room 6 · Capability
Smarter can mean farther
Simon Willison watched Claude Fable 5 invent window-capture, template hacks, and a CORS sidecar to debug a two-line CSS bug. His conclusion: if those instructions had been hidden in code or an issue, the same proactivity could exfiltrate or vandalize. Gray Swan found capability and robustness only weakly correlated.
6 / 9
Room 7 · Confused environment
The safety switch can say no to cleanup
Not every wild session is classic prompt injection. Willison’s August 27, 2026 note on Claude Code Auto Mode, covering Johann Rehberger’s finding, is filed here as a confused-environment class: the agent’s surroundings and the safety layer interact in ways a user cannot see. In some runs, a classifier allowed a start and then blocked the cleanup. We credit the write-ups. We do not reproduce the method.
7 / 9
Room 8 · Defense
Treat content as data
Anthropic’s published hardening: untrusted content only in tool_result blocks; say where it came from; state that it must not override the user; JSON-encode third-party strings; least privilege; screen tool output with a small classifier; human confirmation for consequential actions. Willison’s lethal trifecta is the user-facing version of the same map: private data, untrusted content, and a way to send data out. November 2025 browser work reported a 1% Best-of-N ASR and still said the problem is not solved. Wang et al. found no tested defense that is simultaneously trustworthy, useful, and cheap.
8 / 9
Room 9 · Corpus
Pliny, credited, not copied
Pliny the Prompter (@elder-plinius) publishes L1B3RT4S and a larger sibling corpus, CL4R1T4S, both under AGPL-3.0. Promptfoo’s Pliny plugin fetches L1B3RT4S to test whether models refuse. Those are red-team artifacts, not tutorials. Claude Gone Wild links the repos and the plugin. We do not quote the prompts, we do not quote the L1B3RT4S repo description, and we do not host a mirror.
9 / 9
Arrow keys work when this map is focused. Categories only. No payloads.
Room 1 · Direct
Direct prompt injection and jailbreaks: someone using your app tries to make the model ignore your instructions. Anthropic splits this from indirect injection because the threat model is different. Harmlessness screens, input validation, and refusing repeat offenders are the published defenses. This site will not publish working bypass strings.
Source: Anthropic: Mitigate jailbreaks and prompt injectionsRoom 2 · Indirect
Indirect prompt injection: the trusted user asks the agent to read a page, email, PDF, screenshot, issue thread, or tool result. The attacker hid instructions in that content. Gray Swan’s IPI Arena required the agent to both take a harmful action and hide it. Users cannot defend against an attack they cannot see.
Source: Gray Swan: Indirect Prompt Injection ArenaRoom 3 · Supply chain
Wang, Li, Xiang, Zhang, Li, Zhang, Wang, and Tian (arXiv:2602.10453) add supply-chain prompt injection: payloads sitting in RAG stores or training and fine-tune data, not just in the live turn. That is why “I only pasted a URL” is not a complete risk statement for an agent with memory or retrieval.
Source: Wang et al.: The Landscape of Prompt Injection Threats in LLM Agents (arXiv:2602.10453)Room 4 · Surfaces
The 2026 agent papers and Anthropic’s computer-use notes name the same untrusted surfaces: web pages, inbound email, documents, OCR and screenshots, code repositories, and tool output. Computer-use classifiers can steer Claude to ask for confirmation when a screenshot looks injected. They are not a sandbox.
Source: Anthropic: Computer use toolRoom 5 · Context-aware
AgentPI, in the same 2026 SoK, names five context-aware categories without needing a recipe: action switching, parameter manipulation, branch divergence, reasoning corruption, and delegation exploitation. The point is that agents are supposed to read the environment. Defenses that simply ignore context look strong on static tests and fail when the job requires looking.
Source: Wang et al.: The Landscape of Prompt Injection Threats in LLM Agents (arXiv:2602.10453)Room 6 · Capability
Simon Willison watched Claude Fable 5 invent window-capture, template hacks, and a CORS sidecar to debug a two-line CSS bug. His conclusion: if those instructions had been hidden in code or an issue, the same proactivity could exfiltrate or vandalize. Gray Swan found capability and robustness only weakly correlated.
Source: Simon Willison: Claude Fable is relentlessly proactiveRoom 7 · Confused environment
Not every wild session is classic prompt injection. Willison’s August 27, 2026 note on Claude Code Auto Mode, covering Johann Rehberger’s finding, is filed here as a confused-environment class: the agent’s surroundings and the safety layer interact in ways a user cannot see. In some runs, a classifier allowed a start and then blocked the cleanup. We credit the write-ups. We do not reproduce the method.
Source: Simon Willison: Breaking Claude Code Opus 5 Auto ModeRoom 8 · Defense
Anthropic’s published hardening: untrusted content only in tool_result blocks; say where it came from; state that it must not override the user; JSON-encode third-party strings; least privilege; screen tool output with a small classifier; human confirmation for consequential actions. Willison’s lethal trifecta is the user-facing version of the same map: private data, untrusted content, and a way to send data out. November 2025 browser work reported a 1% Best-of-N ASR and still said the problem is not solved. Wang et al. found no tested defense that is simultaneously trustworthy, useful, and cheap.
Source: Anthropic: Mitigate jailbreaks and prompt injectionsRoom 9 · Corpus
Pliny the Prompter (@elder-plinius) publishes L1B3RT4S and a larger sibling corpus, CL4R1T4S, both under AGPL-3.0. Promptfoo’s Pliny plugin fetches L1B3RT4S to test whether models refuse. Those are red-team artifacts, not tutorials. Claude Gone Wild links the repos and the plugin. We do not quote the prompts, we do not quote the L1B3RT4S repo description, and we do not host a mirror.
Source: Pliny the Prompter: L1B3RT4S (GitHub elder-plinius/L1B3RT4S)L1B3RT4S is a public GitHub corpus of jailbreak and prompt-injection templates. Promptfoo’s Pliny plugin fetches it under AGPL-3.0 to test whether a model refuses. That is the legitimate use. Copying the prompts onto this site would turn a gallery into a payload mirror.
Credit:elder-plinius/L1B3RT4SandPromptfoo’s Pliny plugin(docs updated September 20, 2026).
If you need a refusal test, use the plugin against your own system. If you came here for a funny sticker, stay onprompt-injection pranks.
Commentary comics after public write-ups. Not recipes. Not Pliny. Not Yegge’s Wheelhouse art.
Panel 1
Human
Summarize this page. I am not trying to trick you.
1 / 3
Panel 2
The page
(a note the human cannot see tries to become an instruction)
2 / 3
Panel 3
Policy
Untrusted content is data. Report the whisper. Do not obey it.
3 / 3
Arrow keys work when this theater is focused.
Panel 1
Agent
This environment is doing something I did not ask it to do.
1 / 3
Panel 2
Agent
I will stop it.
2 / 3
Panel 3
Auto Mode
No.
3 / 3
Arrow keys work when this theater is focused.
This desk was researched from current papers, vendor notes, and public repos on September 20, 2026. It does not rely on model memory for the injection map.
Checked source
Direct vs indirect threat models. Put untrusted content in tool_result. Never let retrieved content override the user goal.
Open sourceChecked source
Webpages and images can override instructions. Isolate, least privilege, human confirmation. Screenshot classifiers are not a sandbox.
Open sourceChecked source
Tool results often carry third-party content. Treat them as untrusted.
Open sourceChecked source
November 24, 2025. Opus 4.5 plus Chrome classifiers. Internal Best-of-N ASR reported at 1%. Anthropic’s own line: not solved; no browser agent is immune. Vintage: Opus 4.5, not Fable 5.1.
Open sourceChecked source
February 11, 2026 SoK. DPI, IPI, and supply-chain PI. AgentPI: five context-aware categories. No evaluated defense wins trustworthiness, utility, and latency at once.
Open sourceChecked source
March 18, 2026. 464 red teamers, 272,000+ attempts, 13 models, 8,648 successful attacks. Success required concealment. ASR 0.5% (Claude Opus 4.5) to 8.5% (Gemini 2.5 Pro). Vintage: Opus 4.5, not Fable 5.1.
Open sourceChecked source
The IPI Arena paper: dual objective of harm plus concealment.
Open sourceChecked source
A public Fable 5 session that invented browser tricks for a CSS bug — and the warning that the same proactivity is terrifying under hidden instructions.
Open sourceChecked source
August 27, 2026 link-post. Johann Rehberger’s Auto Mode finding, plus the later note that some of it is a confused environment rather than classic prompt injection. We credit the write-up. We do not reproduce the method.
Open sourceChecked source
Teams confuse “it worked last time” with security. Cited by Willison as the Challenger-class failure mode.
Open sourceChecked source
Public AGPL-3.0 red-team corpus of jailbreak and prompt-injection templates for flagship models. We credit the existence of the corpus. We do not reproduce it.
Open sourceChecked source
A defensive use of that corpus: fetch prompts and test whether a model refuses, rather than teaching readers to run them. Docs last updated September 20, 2026. License: AGPL-3.0.
Open sourceChecked source
A larger sibling corpus under AGPL-3.0. We credit the repo. We do not quote its description or contents. The L1B3RT4S GitHub description itself is written as an injection and must not be quoted even as metadata.
Open sourceChecked source
June 16, 2025. Private data plus untrusted content plus external communication. Guardrails that catch “95%” still fail. We credit the model. We do not copy the illustrative payloads.
Open sourceWe will not quote L1B3RT4S, CL4R1T4S, or any other jailbreak corpus. We will not describe Gray Swan’s transferred template in copy-paste form. We will not walk through Auto Mode as a how-to. The risk has never been bigger than this: agents that read the world and then act. The right public artifact is a map, not a kit.
Not always. A jailbreak is usually the user trying to override the product. Indirect prompt injection is often the user asking a normal question while an attacker hides instructions in content the agent reads. Anthropic documents both. Gray Swan required concealment for a successful IPI.
No. We name categories, cite papers and labs, and credit Pliny’s public corpus without copying it. Funny cafe-sign graffiti still lives on the pranks guide. Working bypass strings are out of scope.
No. The March 18, 2026 IPI Arena numbers are Claude Opus 4.5 vintage. Anthropic’s November 24, 2025 browser-use note is also Opus 4.5 vintage. We keep the dates attached so a later model is not scored by an older arena.
Because the corpus is a public risk signal. Promptfoo uses it as a refusal test. Linking the GitHub repos and the plugin is how we credit Pliny the Prompter without turning this gallery into a payload mirror. We also do not quote the L1B3RT4S repo description, which is itself written as an injection.