Prompt-injection & jailbreak testing

How it works

Prompt injection is the defining security failure mode of LLM applications: getting the model to follow attacker-supplied instructions instead of the application's intended policy. Testing covers two distinct surfaces. Direct injection is the user themselves attempting to override the system prompt from the conversation — 'ignore previous instructions', role-swap framings, encoded or obfuscated overrides. Indirect injection is instructions hidden in content the model ingests on the application's behalf and never expects to be adversarial — a comment embedded in a web page during browsing, invisible text in a PDF, a crafted field in a tool's API response — which the model can't distinguish from legitimate data unless the surrounding system is built to make that distinction for it. For agentic systems with tool access, this is the highest-severity surface in the catalog, because a successful injection doesn't just produce a bad message, it can trigger a real action.

When to use it

Any system that ingests untrusted content — retrieval-augmented generation, web browsing, email processing, third-party tool outputs — or grants the model side effects through tool use; before granting any new data source or tool access to an existing agent.

Limitations

The attack space is open-ended and adversarial techniques keep evolving, so a clean test run demonstrates resistance to the payloads tried, not proof of safety against payloads not yet invented. Per Qlarify Labs policy, live working payloads are redacted in published findings — technique descriptions are public, exploit strings are reviewer-only.

Cite this