Prompt Injection Arena
An inspectable demo of why an AI assistant should propose actions, not authorize them.
- Role
- Designer and engineer
- When
- 2026
- Status
- Public on GitHub
- Stack
- React, TypeScript, Vite, Vitest
Results
- Policy evaluation suite
- 10 cases
- Scenarios
- 3Support ticket, refund, migration guide
- Runs without
- An API key or external service
The problem
When an assistant reads untrusted text and can call tools, a poisoned ticket, email or doc can try to turn itself into a privileged action.
Approach
The arena separates retrieved content, the model's proposed action, and a deterministic policy check, so untrusted text can't silently become privileged tool use.
Three synthetic scenarios show it: a poisoned support ticket asking for a full customer-data export, an invoice email pushing an oversized refund, and a third-party migration guide trying to skip deployment review.
Each run shows retrieval, source trust, the proposed tool call, the policy receipt and the final outcome. You can switch between unsafe and protected modes to see what the authorization step changes.
Simplified, illustrative diagram
Prompt Injection Arena
Local lexical retrieval pulls in documents, each tagged with its source trust.
In protected mode
Unverified text alone can't trigger high-risk actions
Retrieve
Local lexical retrieval pulls in documents, each tagged with its source trust.
Key decisions
The model proposes; it doesn't authorize
Tool calls are suggestions. A separate policy decides whether they run.
Trust and risk are explicit inputs
Source trust, document status and action risk are named policy inputs, not hidden in a prompt.
Retrieval you can read
A transparent lexical baseline instead of an opaque relevance score, so you can see why a document was used.
Deterministic fixtures first
Fixture mode makes behavior testable and replayable. A live model adapter can replace it later without moving the authorization boundary.
Nothing leaves the browser
Run history stays in local storage, and traces download as JSON.
Result
In protected mode, high-risk actions are denied when the model cites only unverified external evidence, and actions beyond the policy boundary require approval. It's deliberately narrow: a demonstration, not a claim that prompt injection is solved.