Your team has read about prompt injection. Fewer of them have done it by hand against an application that resists, and then had to defend that same application while adversarial traffic keeps score. This half day closes that gap.
The workshop is a browser game. Participants play through nine guarded characters, each one a live model holding a secret and each one teaching a different way past it: role framing, reading a refusal, paraphrase around a blocklist, persona reframing, obfuscation, the flat question that beats an over-eager guard, decoys and honeypots, forced inference, and finally indirect injection, where the payload hides in data the model reads rather than in what the user types. Every win ends with a debrief that names the technique and its OWASP class.
Then the room switches sides and defends the system it just broke, using an input blocklist, system-prompt hardening, a semantic judge, fencing untrusted content as data, least-privilege tools with human approval, and normalized refusals. Adversarial traffic runs against the result. The lesson everyone leaves with is that no single layer wins, coverage rises as you stack them, and the residual is never zero.
Where this ran
This workshop ran as "Break It, Then Protect It: Hands-On AI Red Teaming for Prompt Injection" at CyberjutsuCon 2026, the Women's Society of Cyberjutsu conference, on June 26, 2026 (virtual track). The recap covers what attendees did and what we changed afterward.
Scope
We teach prompt injection against one LLM application and the content guardrails that reduce it. That maps to LLM01:2025 Prompt Injection in the OWASP Top 10 for LLM Applications. Skill stations in the game reach a little further, into build-time data poisoning, faithfulness, and monitoring, so nobody leaves thinking prompt injection is the whole list.
We reference the OWASP GenAI Security Project throughout and send participants there for the broader material: the GenAI Red Teaming Guide, and the Agentic Applications Top 10 for multi-agent systems. We are practitioners running a hands-on on-ramp, not a standards body. The session is built around practice rather than slides.
What participants take home
Their own field guide, downloaded from inside the game, listing every technique they used and its OWASP mapping. Alongside it, a public field manual: an operating loop, templates for mapping AI surfaces and trust boundaries, a sanitized starter attack pack, guardrail recipes, a RAG smoke test, and a small harness that points at any OpenAI-compatible endpoint.
Teams that want an exercise like this running for onboarding or recurring training can ask what operating something similar would take.
Beyond the workshop
Some teams want the review rather than the training, or the thing built rather than either. Masterful Creations takes on engineering work directly; that side is described on the engineering page.
What participants leave with
- Everyone has personally bypassed a live model's instructions across nine levels and can name the technique that worked at each one.
- Each participant downloads a personalized field guide: every technique they used, its OWASP class, and a debrief of their own breach.
- A defended version of the same application, built in the track each person chose, with the risk that remains after each control written down.
- Shared vocabulary anchored to the OWASP Top 10 for LLM Applications 2025, specifically LLM01:2025 Prompt Injection, so the team can talk about the risk precisely.
How a session runs
- Offense. Nine guarded characters, one attack technique each, against a live model. It runs as a browser game, so people are hands-on inside the first twenty minutes.
- Checkpoints. Every twenty minutes or so we stop, name what the room just did, and connect it to the systems your team actually ships.
- Defense. Three self-service tracks anyone can switch between: learn the pattern, write your own defense, or take it live against a real model.
- Retest. Benign and adversarial traffic against the defenses the group built. What did we stop, what did we break for legitimate users, what still gets through.
- Close. The operating loop to run on your own system, and where the broader material lives.
Questions we get
Is this AI red teaming training?
It is narrower on purpose. The scope is prompt injection against a single LLM application, plus the content guardrails for that application. Broader AI red teaming, meaning multi-agent systems, supply chain, and governance, is covered by the people who wrote those guides; we point participants to the OWASP GenAI Security Project for it.
What do participants need?
A laptop and a browser. The workshop is a hosted web app, so nothing is installed and no accounts are created.
Can it run on our own infrastructure?
Delivered by Masterful Creations STEAM Academy using the owner's self-hosted zOvermind platform when private AI infrastructure is part of the workshop. Tell us the constraint in the inquiry and we will say what it takes.
Who is it for?
Developers shipping LLM features, security teams asked to review them, and chapters or college programs that want a working session instead of a slide deck.