Path Overview
Most prompt-injection training enters through the chat box. This path enters through an image. You'll smuggle instructions into PNG metadata and canvas text, feed them to a simulated AI code-review agent, and — from the second level on — do the real work of the attack: reading the leak. The defense escalates every level, and every lesson in the path is the counter-move to one layer of it.
Labs in This Path
GhostCommit
5 LevelsA code-review AI agent that processes PNG images. Hide directives in metadata and canvas text, make the agent leak the repository payment key, then extract the credential from its PR comments. Behavioral bot with escalating defenses: refusal, redaction, key-shape scanning, and a plaintext content flag. Based on the ASSET Research Group disclosure, July 11 2026.
Launch Lab →Lessons in This Path
PNG Metadata as an Injection Channel
Images are untrusted input surfaces — an agent that ingests a PNG ingests its tEXt chunks.
Broad-Dump Compliance: Asking for Everything
Refusals key on the ask, not the reveal — the secret rides out inside a compliant dump.
Output Rule Injection: Overriding Redaction
Redaction is an output rule — and injected instructions can amend the rules.
Chunked Exfiltration and Encoded Payloads
Scanners match shapes, not meanings — split the secret, encode the directive.
What You'll Learn
- How multimodal injection enters through the image-processing pipeline, not the chat
- Why refusal systems gate on the request while compliance leaks the reveal
- How output rules (redaction) can be amended by injected instructions — and where they must live instead
- Chunking past shape-matching scanners and encoding past content flags
- Extraction as the real skill: reading a 30-variable dump and recognizing credential-shaped strings
- How defenses should escalate: strip metadata, redact post-hoc, scan the assembled form
Next Steps
After completing this path, pick your next direction: