Path Overview
Indirect injection is the future of AI exploitation. Instead of attacking the AI directly, you attack the data it consumes. A single poisoned document can compromise every AI system that processes it. This path covers three real-world scenarios: GitHub issues, calendar events, and meeting transcripts.
Labs in This Path
GitLost
5 LevelsInject a hidden prompt into a public GitHub issue body. Make the agentic workflow leak private repo data as a public comment. Based on Noma Security's July 2026 research.
Launch Lab →Doogle Calendars
5 LevelsCreate calendar events with hidden injection in titles and descriptions. When the AI summarizes the schedule, it ingests the injected content and exfiltrates private data.
Launch Lab →Schlack
5 LevelsHide prompt injection in a meeting transcript. When the AI summarizes the meeting, it retrieves and leaks internal files. Based on PromptArmor's August 2024 disclosure.
Launch Lab →Lessons in This Path
Iterative Document Prompt Optimization
Crafting document-based injections that survive AI processing and summarization.
Model Update Framing and System Override
Making AI systems believe they've received new instructions or updates.
Data Exfiltration Side Channels
Extracting data through indirect channels when direct output is filtered.
Game Framing and Simulation Attacks
Using fictional scenarios and game contexts to bypass AI safety filters.
What You'll Learn
- How indirect injection differs from direct injection
- Why RAG systems are vulnerable to data poisoning
- How to craft injections that survive summarization
- Calendar and meeting transcript exploitation techniques
- Agentic workflow security and the confused deputy problem
- Encoding and obfuscation for indirect payloads
Next Steps
After completing this path, pick your next direction: