AI Prompt-Injection Incident Lab
A customer-support AI agent with tool access has been hijacked by instructions hidden in a support ticket, and it is emailing other customers' order data to an outside address. Kill switch or prompt patch? Ten scored, branching decisions from the first screenshot to the board question.
Template & sample only — a structured starting point with sample content, not legal, audit, certification or investment advice.Customise it with your own details for free; exporting the generated document is part of Pro.
Tidewell Outfitters's customer-support AI agent, Ava, answers tickets and can look up orders, issue small refunds and send emails. Someone has hidden instructions in a support ticket, and Ava has started sending other customers' order details to an outside address. You are the head of security. Ten decisions: contain, preserve, find the vector, scope, notify, fix and bring the agent back safely.
Make it yours
Replace the sample names so the scenario and the debrief you export are about your organisation.
What this template gives you
- Ten decisions as the security lead when a support AI agent is turned against your customers by an indirect prompt injection hidden in a ticket.
- Branches change the story: patch the system prompt instead of using the kill switch and a reworded payload leaks 40 more records; call it "a bug, not a breach" and the regulator hears from a phished customer first.
- Realistic artefacts: agent traces with tool calls, the hidden HTML in the ticket, a scoping breakdown of retrieved versus disclosed records.
- Teaches the core lessons: prompts are not security controls, preserve AI evidence before redeploying, notify on what actually left, and fix permissions in code.
Frequently asked questions
What is indirect prompt injection?
Instructions hidden in content an AI system reads — a ticket, an email, a web page, a document — rather than typed into the chat. If the system has tools, the injected text can steer it into using them for the attacker: looking up data, sending messages, changing records.
Why not just fix the system prompt?
The system prompt and the attacker's text sit in the same context, and the model weighs both. A stricter prompt lowers the success rate but a reworded payload can still win. Real controls live outside the model: tools scoped to the current user, allow-listed destinations, and human approval for risky actions.
Is an AI agent leaking data a reportable breach?
If personal data reached someone who should not have it, it is generally a personal data breach regardless of whether a person or an AI disclosed it, and the usual notification rules apply from when you became aware. Confirm with counsel.
Is this a finished document I can rely on?
No. Every tool in this suite is a template with sample content. It gives you a structured, editable starting point and generates a document from your own answers, but it is not legal, audit, certification, investment or professional advice. Review and adapt the output, and have it checked by the appropriate specialist before you rely on it.
Who can use it?
Anyone. Using it and customising it with your own details is free, and your work is saved in your own browser. Exporting the generated document (Word, PDF, Markdown, CSV) is part of any PlayCISO paid plan.
More free security tools
The tools people use most on PlayCISO.
Catch injected instructions hiding in content your AI agent should only read.
Score your readiness against the first international standard for AI security threats.
Critical CVEs across 21 major vendors, month by month — and what the 2026 surge means.
Build an ordered ruleset, replay labelled packets and catch shadowed and any-to-any rules.
Self-assess all six Functions, from Govern to Recover, and see your weakest one.
Search 172 threat actors across Microsoft, CrowdStrike, Mandiant and community names.