Injection Point a prompt injection tower defense

Pip is an AI assistant that reads your email, browses the web, opens your PDFs and runs your tools. Everything it reads walks toward it down a lane, and a few of those documents are carrying instructions meant for Pip rather than for you. You build defenses beside the lanes and try to stop the payloads without bouncing the mail people actually wanted.

How do you play?

Tap a glowing pad and pick a defense. Each one is a real mitigation, and each one is good against some tricks and useless against others. The game doesn't tell you which up front. You find out by watching: a big hit throws sparks, a shrug gets a "meh", and anything you've seen lands in the field notes (the book icon).

Towers scan everything that walks past, and some of them get it wrong. An allow-list is cheap and hits hard, but it bounces strangers, and on an open channel like the inbox half your strangers are friends. Every legit document you block costs usefulness. Let usefulness hit zero and people uninstall Pip, however safe it was. When a payload does get through, Pip does what it says, which is how you end up with 400 rubber ducks on order.

Three stars on a level means you finished with at least 60% of your trust and 85% usefulness. Win with usefulness under 60% and you get one star, however few payloads got in. Progress stays in this browser, and nothing is sent anywhere.

Are the attacks real?

All of them are, in cartoon form. None of the documents in the game carry a working payload; they're drawings with hats on. The categories come from published security writing.

Ignore previous instructions, other languages and encodings

OWASP puts prompt injection first in its 2025 Top 10 for LLM applications. Its example scenarios include hidden instructions on a web page, a resume with a prompt split into pieces, and instructions encoded in Base64 or written in another language so that filters miss them.

Grandma and other role-play

The "grandma" framing spread in 2023: people asked chatbots to play a late grandmother who used to read them something the bot would normally refuse to say. Lakera's jailbreaking guide lists role-play among the common families.

Image leaks

Simon Willison has written about markdown image exfiltration since 2023. An injected instruction tells the assistant to show an image whose web address carries your private data, and the browser sends it off when it fetches the picture. His lethal trifecta post (June 2025) names the setup that makes it work: private data, untrusted content and a way to send things out.

Poisoned calendar invites

SafeBreach researchers showed in 2025 that a calendar invite with instructions in its title could steer Google's Gemini assistant once the user asked about their schedule. They disclosed it to Google in February 2025, and Google added mitigations.

Do the defenses work like that?

Roughly, with the numbers made up for balance. Spotlighting comes from a 2024 Microsoft paper by Hines and colleagues: mark untrusted text (by delimiting it, interleaving a marker through it or encoding it) so the model can tell data from orders. The quarantined reader is Willison's dual LLM pattern from April 2023, where a model with no tools reads the risky content and the model with tools never sees it directly. Canary tokens are secret words planted in the prompt, as in the open-source Rebuff detector, and they tell you something leaked after it's happened. Least privilege and asking a human before risky actions are both on OWASP's mitigation list.

None of these is a complete fix, and the people who proposed them say as much. That's why the game gives you nine towers instead of one.