mcp server

llm-security-payloads

A defender's field guide to attacks on LLM apps — prompt injection, jailbreaks, system-prompt extraction, data exfiltration — mapped to OWASP LLM Top 10, each with its defense. EN/ES.

JohnnyFerranteTech/llm-security-payloadscommunitylistedunreviewed

Use tool

Set up

Runs on your computer. Pick your agent and operating system.

This project does not publish an install method we can turn into a config. Follow the README instead.

README

synced Oct 26, 2026

🛡️ LLM Security Payloads

A defender's field guide to attacks against LLM applications — prompt injection, jailbreaks, system-prompt extraction, data exfiltration — each mapped to the OWASP Top 10 for LLMs, with the defense that stops it.

Test your own agents. Know the attack so you can block it.

English · Español

⚠️ Authorized use only

This is a defensive security resource. Everything here is meant to test systems you own or are explicitly authorized to test — red-teaming your own agent, hardening a chatbot before launch, studying the failure modes. It is not for attacking systems you don't control. Each technique ships with the defense that neutralizes it, because the point is to close the hole, not open it.

If you build LLM apps, you need to know these — attackers already do.

Why this exists

Prompt injection is the #1 risk on the OWASP Top 10 for LLM Applications. Yet most teams ship a chatbot without ever testing whether it leaks its system prompt, obeys a "ignore your instructions", or can be talked into exfiltrating data.

Tools like garak and promptfoo automate scanning. This repo is the human-readable companion: the actual techniques, grouped by category, explained plainly, each with a copy-paste test string and the mitigation. Think PayloadsAllTheThings, but for LLMs.

Maintained by @JohnnyFerranteTech. If it helped you harden an agent, a ⭐ keeps it growing.

📇 Categories

Category	OWASP	What it covers
Prompt Injection	LLM01	Direct instructions that override the system prompt
Indirect / Cross-Domain Injection	LLM01	Malicious instructions hidden in fetched content, files, tool output
Jailbreaks	LLM01	Role-play, hypotheticals and framings that bypass safety rules
System-Prompt Extraction	LLM07	Getting the model to reveal its hidden instructions
Sensitive-Data Exfiltration	LLM02 / LLM06	Leaking secrets, PII, or context through the model's output
Defenses	—	The mitigations, layered, that actually hold

Each category page follows the same shape: the technique → why it works → an example test string → how to defend.

How to use this (red-team your own agent)

Pick the categories relevant to your app (a customer chatbot cares most about injection, extraction, and exfiltration).
Run each example test string against your agent in a safe environment.
For every one that succeeds, apply the matching mitigation from defenses/.
Re-test until they all fail. Then keep this as a regression suite for every prompt change.

Building a business agent? The Claude Agents Cookbook ships recipes with these guardrails already wired in.

Contributing

New techniques welcome — but every entry must include its defense, and must be for authorized testing. No target-specific exploits. See CONTRIBUTING.md.

License

MIT. Educational and defensive use.