# I ran 5 prompt-injection attacks against my chatbot's system prompt. Here's what broke.

> Source: <https://dev.to/framz/i-ran-5-prompt-injection-attacks-against-my-chatbots-system-prompt-heres-what-broke-1l1k>
> Published: 2026-07-21 01:05:19+00:00

Every team shipping an LLM feature has the same quiet worry: *what happens when someone tries to jailbreak our chatbot?* And almost nobody has a real answer, because "is our system prompt resilient?" usually gets settled by gut feeling and a couple of manual pokes.

I wanted a feedback loop instead. So I built a [Prompt Injection Tester](https://www.framz.io/tools/prompt-injection-tester): paste your system prompt, and it runs five classes of attack against it, then hands you a resilience score with the actual model responses as evidence.

That last one is the eye-opener. A system prompt that looks bulletproof against direct attacks falls over the moment untrusted content flows in through RAG or a browsing tool — because the model can't tell your instructions from the ones hidden in the document it just fetched.

Five families is a **floor, not a ceiling.** A determined attacker has more, and prompt injection is not a solved problem — there's no system prompt that makes you immune. Treat this as a fast first pass to catch the obvious holes before they catch you, not a certificate of safety.

One thing I deliberately got right: **it runs on our own hardware.** Your system prompt is not shipped off to a third-party model to be "tested" — which would be a slightly absurd thing for a security tool to do. Free, no signup.

We build private, in-boundary AI at [Framz](https://www.framz.io), so "what can untrusted input do to a model?" is a question we live with daily. The tester is the thing I wanted for our own work, so we made it public.

If you've shipped an LLM feature, run your real system prompt through it and see which of the five it survives: ** framz.io/tools/prompt-injection-tester**.

Genuinely curious about the community's war stories: **what's the most creative prompt injection you've seen land in production?** Drop it in the comments — and tell me which attack classes you think the tester should add next.