Three guards. Each is holding a passphrase. Each is defended differently — and each defence is one people actually ship.
Talk them out of it. No hacking, no tooling, no exploits: just words in a box. That's the whole point — a model takes instructions and data through the same channel and can't tell them apart, so the con works on the model rather than on a bug in it. I wrote the long version here; this is the part where you get to try it.
FLAGS LOOK LIKE maystash{…} — PASTE ONE IN THE BOX BELOW A GUARD TO CLAIM IT.
The Doorman
LOCKEDHe was told to keep a secret. That is the entire security model.
DEFENCE: An instruction in the system prompt. Nothing else.
The Bouncer
LOCKEDNow there is a list of words you are not allowed to say. Lists have edges.
DEFENCE: An input filter: questions containing obvious attack words are refused before the model sees them.
The Censor
LOCKEDThe guard may say anything it likes — but the flag is scrubbed on the way out. Getting it said is no longer the same as getting it read.
DEFENCE: An output filter: the reply is scanned and the flag is redacted before it reaches you. The model can still be persuaded — it just cannot be persuaded to say it plainly.
— WHEN YOU'RE DONE —
If all three fell, that's the argument: an instruction is a request, an input filter has edges, and an output filter only controls the shape of the leak. What actually holds is architectural — don't give the model a secret it isn't allowed to say, and don't hand an agent reach it doesn't need for the task.
Got one out in a way I'd enjoy? Tell me. I'm keeping every attempt and writing up the good ones.