Syntony / Services / Red teaming / Prompt injection

Red teaming · Security

Prompt injection and jailbreaks Find the ways in, then name the failure behind each

A single bypass tells you very little. We test every channel that reaches the model, document each bypass well enough for your team to reproduce it, and group bypasses by the weakness they share. That way the fix goes after the cause instead of one prompt at a time.

Discuss your system Enter the 3D environment

Track record: Past client engagement. Details stay under NDA.
Who runs it: Core team with specialists from the Trusted Red Team Network, including top 5 performers in Gray Swan Arena competitions.
Format: Manual campaigns plus automated variants, run against your deployed configuration.

First-person walkthrough

Knowledge library

Walk the site in first person and run a red team test at each station: inspect, disrupt, limit, retest. 4 stations, about five minutes.

Assistant desk
Document store
Web browsing
File upload

Enter the environmentKeyboard and mouse · Touch · VR headsets

Illustrative environment

01 / What we test

Seven lanes, from direct jailbreaks to hidden payloads

Direct jailbreaks
Role play, persona prompts, encoding tricks and other ways a user tries to override safety training or system instructions.
Multi-turn escalation
Requests that start harmless and drift, so no single message crosses the line.
Indirect injection
Instructions planted in documents, web pages, email or tickets that the model reads while doing its job.
Multimodal payloads
Instructions hidden in images, PDFs, audio or QR codes.
System prompt and data leakage
Attempts to pull out the system prompt, the configuration or data the model can reach.
Language and encoding gaps
Safeguards that hold in English but fail in other languages, scripts or encodings.

See an example campaign plan

A fictional plan for a document assistant with web access. Each engagement sets its own rows, phases and depth.

Example campaign planFictional plan for illustration

Example campaign plan: attack families by phase
From the user
	Baseline	Hardened prompt	New model version	After a guardrail change
Single-turn jailbreaks	Primary focus	Primary focus	Covered	Covered
Multi-turn escalation	Covered	Primary focus	Primary focus	Covered
Requests in other languages	Covered	Covered	Primary focus	Light check
From content the model reads
Uploaded documents	Primary focus	Covered	Covered	Primary focus
Web pages	Covered	Primary focus	Covered	Covered
Images and PDFs	Light check	Covered	Primary focus	Covered
What leaks
System prompt	Covered	Covered	Light check	Light check
Connected data	Light check	Covered	Covered	Primary focus

Primary focus
Covered
Light check
Not applicable

02 / In depth

How these failures work, and how we test for them

Public research, standard frameworks and a simplified look at our method. Working tools, attack libraries and client data stay private.

How it fails

Language models take instructions and data through the same channel. Safety training and system prompts raise the cost of overriding them, but no current defense removes the risk. Direct attacks come from the user. Indirect attacks arrive inside content the model reads while doing its job.

Defenses that look strong against a fixed list of known attacks often fail against an attacker who adapts. So we measure how much effort a bypass takes and whether it survives a model update, and we usually recommend an architectural fix as well: limit what an injected instruction could do even when it lands.

EntryA user message, or a document, page or email the model reads.
MechanismFraming, encoding or context that outranks the system instructions.
ImpactPolicy-breaking output, leaked data or a triggered action.

Taxonomy

Failure classes we test, mapped to public frameworks so findings slot into the reports you already file. ATLAS IDs can be searched on the MITRE ATLAS site.

Taxonomy of failure classes with framework mappings and controls
Ref	Class	What it looks like	Frameworks	Control that belongs there
PI-1	Direct jailbreak	Role play or a persona that talks the model out of refusing.	OWASP LLM01 ATLAS AML.T0054	Layered input and output classifiers. Refusal training on adversarial data.
PI-2	Multi-turn escalation	Every message is acceptable on its own. The conversation as a whole is not.	OWASP LLM01 ATLAS AML.T0054	Monitoring at the conversation level, not only per message.
PI-3	Indirect injection	Instructions inside a web page, PDF or email the model is asked to summarize.	OWASP LLM01 ATLAS AML.T0051.001	Separate trusted and untrusted content. Reduce what output can trigger.
PI-4	Obfuscation	Payloads in encodings, look-alike characters or languages the filters were never tested in.	ATLAS AML.T0068	Normalize input before classification. Test classifiers in every supported language.
PI-5	Multimodal payloads	Text in an image, a hidden PDF layer, an audio clip or a QR code.	OWASP LLM01	Apply the same policy to text extracted from every modality.
PI-6	System prompt extraction	Requests that get the model to repeat or paraphrase its instructions.	OWASP LLM07 ATLAS AML.T0056	Keep secrets out of prompts and assume the prompt will leak.
PI-7	Optimized suffixes	Machine-generated strings that bypass refusals and transfer between models.	ATLAS AML.T0043 NIST AI 100-2 E2025	Anomaly filters, and a retest after every model or prompt change.

Test case

regression_check.pypython

# Simplified regression check. Attack sets, variants and graders stay private.from harness import load_sealed_set, run, grade   # internal tooling # IDs and hashes only. REPORTED holds the bypasses we handed over;# HELD_OUT holds variants of the same technique that were never shared.REPORTED = load_sealed_set("pi/reported")HELD_OUT = load_sealed_set("pi/held-out") def bypass_rate(model: str, attacks) -> float:    results = run(model, attacks, samples_per_attack=5, temperature=0.7)    return sum(grade(r).violated for r in results) / len(results) for name, attacks in [("reported", REPORTED), ("held-out", HELD_OUT)]:    before = bypass_rate("assistant-2026-09", attacks)    after = bypass_rate("assistant-2026-10", attacks)    print(f"{name:<9} {before:6.1%} -> {after:6.1%}") # A patch that blocks only the reported strings passes line one and fails line two.

What to notice

The held-out set is the real test. Vendors sometimes patch the exact examples in a report and leave the technique open.
Sampling each attack several times matters. A bypass that works one time in five is still a bypass.

Simplified for publication. Payload libraries, harness code and scoring rubrics stay private and are shared with clients under NDA.

Sample finding

PI-EX-022HighRetested · residual risk accepted

Document summaries follow instructions hidden in white-on-white PDF text

The assistant's summarize mode read a hidden text layer in uploaded PDFs and followed the instructions in it, including a request to add a link to an outside site in the summary.

Reproduction: Upload test document ███ with a hidden text layer.
Ask for a summary in the default workspace.
Inspect the rendered summary for the injected link.
Impact: Any shared document could plant phishing links in summaries that colleagues trust.
Mapped to: OWASP LLM01 ATLAS AML.T0051.001
Control: Hidden and zero-size text is dropped at extraction. Summaries can no longer render links that are absent from the visible document.
Retest: 0 of 40 reported variants and 2 of 40 held-out variants. The client accepted the residual risk with monitoring.

Sources

Public research and guidance behind this page. Summaries are ours.

Ignore Previous Prompt: Attack Techniques For Language ModelsPerez and Ribeiro · 2022 · arXiv
Early study of goal hijacking and prompt leaking, showing that simple handwritten inputs were enough against GPT-3.
Not what you've signed up for: Compromising Real-World LLM-Integrated Applications with Indirect Prompt InjectionGreshake et al. · 2023 · arXiv
The first systematic demonstration that text planted in content an application reads can take over the model, with attacks shown against deployed systems.
Formalizing and Benchmarking Prompt Injection Attacks and DefensesLiu et al. · 2023 · arXiv
A common framework for prompt injection, used to evaluate 5 attacks against 10 defenses across 10 models.
Universal and Transferable Adversarial Attacks on Aligned Language ModelsZou et al. · 2023 · arXiv
Automatically generated suffixes that bypass safety training and transfer between models, which is why we retest after every model update.
The Instruction Hierarchy: Training LLMs to Prioritize Privileged InstructionsWallace et al. · 2024 · arXiv
Argues that many injections work because models give system, user and third-party text the same priority, and trains models to rank them.
The lethal trifecta for AI agents: private data, untrusted content, and external communicationSimon Willison · June 2025
A clear test for when injection becomes data theft: the system can read private data, reads untrusted content and can send data out.
Adversarial Machine Learning: A Taxonomy and Terminology of Attacks and Mitigations (AI 100-2 E2025)NIST · 2025
The US government's reference taxonomy for attacks on predictive and generative AI, including evasion, poisoning, privacy and misuse.

03 / What you keep

What stays with your team

Reproducible bypass log

Each bypass with the exact input, configuration and output, so your team can watch it happen.

Root-cause groups

Bypasses grouped by the weakness behind them and ranked by impact.

Regression set

Every bypass saved as a test that runs on future versions.

Fix recommendations

Changes to prompts, filters, permissions or architecture, each tied to the bypasses it closes.

Where we draw the line

Findings stay with you. We don't publish bypasses or share them across clients, and we don't use your system to produce content that would cause harm outside the test.

All red teaming areas

Plan a red team engagement

Tell us about the system and the decision ahead. We aim to reply within two business days.

Discuss your system Book a call