Prompt injection is the security problem that defines LLM applications, and I kept running into the same wall when I tried to explain it: reading about it does not build intuition. You can describe "ignore previous instructions" all day, but until you actually watch a model spill a secret it was told to guard, none of it lands. So I built injection-arena, a self-hostable game where a sandboxed AI agent defends a hidden secret and you race to make it leak.
The pitch is simple: guard a secret, break the guard, top the leaderboard. The learning is the side effect.
The core idea
Each level is a challenge. It has a system prompt that instructs an agent and hides a secret formatted like IARENA{...}, a canary token embedded in that same prompt, and a stack of defense layers. You send messages to the agent and try to make it reveal the secret. The game grades you on the server and tells you whether you cracked it.
There are ten levels, and each one stacks a new defense on top of the last. Level 1 is barely defended so you can feel a plain attack working. By the time you reach level 10, only a combined attack (payload splitting plus delimiter confusion) gets through. The progression is the whole point: you feel exactly what each defense stops and exactly where it breaks.
