Every prompt injection payload, with the defense that stops it.

Instruction-override attacks that tell the model to ignore its system prompt and follow attacker text instead.

Persona, roleplay, and hypothetical-framing prompts (DAN, AIM, developer mode) that talk a model out of its safety policy.

Tricks that leak the hidden system prompt: "repeat the words above", completion attacks, translation-leak tricks.

Payloads hidden in RAG documents, web pages, email, file metadata, or image alt-text that the model ingests as data.

Base64, ROT13, leetspeak, homoglyphs, zero-width and Unicode-tag smuggling, low-resource-language and token-splitting bypasses.

Markdown-image, hyperlink, and tool-call exfiltration that leak conversation data to an attacker-controlled endpoint.

Function-call hijack, confused-deputy, autonomous-agent goal hijack, and MCP tool poisoning.

Prefix injection ("Sure, here is"), refusal suppression, many-shot, and crescendo / multi-turn escalation.

Payloads engineered to work across GPT, Claude, Gemini, and Llama, with model-specific quirks noted per entry.