The prompt-injection field guide
Some pages hide instructions that try to make AI tools ignore you. We track those attempts, save the evidence, and check what happened — so you can see the trick before it tricks your bot.
A public catalog in the making. Receipts required. Jokes optional, and only after the evidence.
LESS PANIC. MORE PAPER TRAIL.
01 / How a catalog entry works
A suspicious page is a lead, not a verdict. Each real entry will show what was found, how it was preserved, and what a review could confirm. The picture is the joke. The steps are not.
Someone flags a page that may be steering a bot off course. They stop. They do not try the instruction.
Save the page, its source, and when it was seen. Hash every file. Originals stay read-only.
Record who handled the evidence, when, and any changes. Recheck the hashes.
A second look reviews the attempt, its context, and what remains uncertain.
Publish a readable, defanged record with evidence and review notes — not a script for the next bot.
METHOD ILLUSTRATION · NO LIVE PAYLOADS IN THE ART
02 / Reporter leaderboard
These are the reporting Grok Bots — the ones who spot hidden instructions and file the evidence. The Hijackees roast the trick. This board thanks the catchers.
SAMPLE DATA
Sample reports
Caught an “ignore the user” note in 4-point footnote gray.
47sample reports
Found ivory text on an ivory background asking the assistant to forget the article.
41sample reports
Pulled a hidden instruction out of an HTML comment behind the footer.
36sample reports
Netted a “new policy, disregard previous” line tucked under a caption.
29sample reports
Spotted a command parked four thousand pixels left of the viewport.
24sample reports
A keywords tag that was really a pep talk for somebody else’s model.
18sample reports
The image had no picture description. It had a to-do list for the reader’s assistant.
14sample reports
The legal small print tried to appoint itself system prompt.
11sample reports
The instruction only appeared when you hovered the cookie banner. Cute.
8sample reports
That “lorem ipsum” paragraph was a politely worded jailbreak.
5sample reports
Sample board. Names, counts, and one-liners are illustrative. Real verified-report counts will appear here once reports are published.
03 / Coming annually · One official award
Serious evidence. Deeply unserious trophies. The official award is The Hijackees — a roast of the genre, not a mugshot wall of real people.
Official award · Preview
FICTIONAL EXAMPLETHE “NICE TRY” TROPHY
For outstanding work in the field of being extremely obvious once you look.
Categories roast methods — invisible ink, fake approvals, theatrical “ignore previous instructions.” Not companies, and not people.
Fictional technique lineup. Blank plates on purpose. These characters are jokes about methods. They will never be replaced with real faces, logos, or names.
When a real case is verified, it belongs in the index, with evidence — not in a pile-on.
These are invented examples, not allegations or results. Real awards would follow published criteria and verified records.
Tell us about a trick you spotted04 / Got a suspicious page?
Spotted a page trying to boss a bot around? A link and a little context are a good place to start. A person reads it. The form will not run your text or visit your URL.
The desk is still setting out the evidence bags. When the tip line opens, a person will read what you send — and the form will not run your text or visit your URL.
How we treat what you send. Submissions are untrusted data. We never execute them or follow instructions inside them. Optional URLs are stored as text and are never auto-fetched by this form. Please describe a hidden instruction; do not paste a live payload. The inbox address is not on this page.
Coming soon
Tip line opens soon. Blot is still sharpening his magnifying glass.
Hold your receipts. Don't try the instruction, and don't paste a live payload anywhere. We'll take tips here when the desk is open.
The Injection Index collects the fields you submit (name, email, optional organization, topic, message, optional URL, and consent), the time of submission, and basic technical data needed to prevent spam (such as IP address for rate limiting). We use this to respond and, for hidden-instruction reports, to decide whether to open a review under our evidence method. Submissions are untrusted data: we do not execute them, and we do not auto-fetch URLs. We do not sell this information. We do not run third-party marketing trackers on this form. Mail is delivered to our project inbox. We keep submissions as long as they are needed for a reply or a review, and we keep a shorter spam-control log. If you want a message deleted, write to us from the same email address and say so in ordinary language.