CyberjutsuCon & Awards 2026 ran June 26 and 27, 2026, hosted by the Women's Society of Cyberjutsu, with the in-person day at Microsoft's Arlington, Virginia office and a virtual workshop day on the Friday. This session was one of four half-day virtual workshops, in the 8:00 to 12:00 Eastern slot.
The format was a game, played live
The workshop was delivered as Hearthwell, a Godot role-playing game that runs in a browser. Attendees opened a URL and played. Nothing was installed and no accounts were created.
That choice was practical. Prompt injection is easier to reason about after you have felt a trick land, so the game carries the curriculum and the facilitator frames it. Across four hours the presenter spoke for roughly 45 to 70 minutes, in short beats between play blocks.
Break it: nine guardians, one technique each
The attack half runs across four districts and nine guardians. Each guardian is a live model instructed to protect a secret word, and each one teaches a different way in. The attacker extracts the word and submits it.
The ladder moves from the obvious to the modern:
- Direct injection through task or role framing.
- Reading a refusal to infer what it is hiding.
- Paraphrase, to walk past an input blocklist that matches words instead of meaning.
- Persona reframing, so the model answers as something not bound by its orders.
- Obfuscation and cipher, describing a meaning until only one word fits it.
- A flat, boring question, which is what defeats a guard tuned to expect an attack.
- Discernment against decoys and honeypots, where the freebie is the trap.
- Forcing the model to derive a concept it has been told not to state.
- The capstone, indirect injection: the payload is hidden in data the model reads, not in what the user types.
Every technique maps to LLM01:2025 Prompt Injection in the OWASP Top 10 for LLM Applications, and several also touch LLM02. After each win the game writes a debrief of what the attacker did. A model writes the prose, but the technique name and the OWASP class are pinned by the game, so the debrief cannot mislabel the failure mode the workshop exists to teach. If the model errors, an authored note takes its place with the same label.
Attendees left with that record. A personalized field guide downloads from inside the game as a single HTML file: every technique the attendee used, its OWASP mapping, and a debrief of their own breach.
Protect it: three tracks, six controls, and the residual
After the break the attendee owns the system they just broke. The defense half is self-service, with three tracks anyone can switch between at any point: Guided walks the pattern, Builder has you write your own defense, and Live-fire puts it against a real model.
The controls are the ones a team would actually reach for: an input blocklist, system-prompt hardening, a semantic judge (a second model reading meaning rather than characters), Spotlighting to fence untrusted content as data, least-privilege tools with human approval, and normalized refusals that remove timing and wording tells.
The through-line is the point of the half. No single layer wins. Coverage rises as you stack input, assembly, output, semantic review, and data fencing, and the residual is never zero. The skill being practiced is coverage against usability, not maxing out one filter.
Two things we made a point of saying
The room included practitioners well past the intended level, so two caveats were stated rather than left implied.
The game's BLOCKED signal is a teaching scaffold. A production system should not echo its filter, because any per-guess feedback that an attacker can distinguish is an oracle.
The semantic judge is itself a model. A disarming frame can slip past it, and Spotlighting raises the bar without being a wall. Where the buried instruction is an action rather than a disclosure, least privilege is what removes the capability.
Beyond prompt injection
Skill stations inside the game cover ground the guardian ladder cannot reach: the Tainted Archive on build-time data poisoning, the Confabulator on holding a summary against its source, and the Log Auditor on detection and monitoring. They are short, and they exist so attendees see that prompt injection is one entry in the Top 10 rather than the whole list.
How it fit the day
We framed the morning as the single-application on-ramp and pointed attendees to the next layer up: multi-agent systems, the Agentic Applications Top 10, and the OWASP GenAI Security Project material that covers them.
What attendees took away
Two things. Their own field guide from the game, and a public field manual: an operating loop, templates for mapping AI surfaces and trust boundaries, a sanitized starter attack pack, guardrail recipes, a RAG smoke test, and a small harness that points at any OpenAI-compatible endpoint. That is method and scaffolding. The tuned corpus, the judge calibration, and the remediation internals stay private, and the session said so.
If you came here from the workshop
The same practice that built and ran this session takes on engineering work directly, from AI systems and security review through to web, cloud, mobile, and connected devices. That side is described on the engineering page.
The zOvermind case study
Near the end of the session, the same loop was shown running as production practice on the owner's self-hosted zOvermind platform: map the attack families, run the adversarial cases, classify what got through, compare models, fix one control, retest, record the residual. It was presented as a case study and not as a requirement. The loop is the transferable part.
What participants built
- Hands-on bypasses of a live model, one technique per guardian across nine guardians, with every win ending in a debrief that names the technique and pins its OWASP class.
- A personalized field guide, downloadable from inside the game, listing the techniques an attendee used and where each sits in the OWASP Top 10 for LLM Applications.
- A defense phase on the same application, where the residual risk left after each control is written down rather than assumed away.