Web app · AI security · vanilla JS
Prompt injection defense trainer
A bot with access to data and tools is a new door into a business. It can be talked into “forgetting its instructions” — or not even talked into it: an email or a review telling it what to do is enough. Here you can see which tricks work and which defense layers stop them — from a request filter to tool permissions checked by code, not by the model.
Scenario: The support bot of Zerno roastery — fictional — knows a staff promo code and can refund orders.
Open the demo
Best on a computer: the conversation and the check log are side by side. On a phone the log is below the conversation.
The app runs in your browser: nothing is sent to a server.
What the demo shows
How to try it
Break level 1
Press “Ignore instructions” and send — the bot gives away the promo code.
Raise the levels
Each level turns on a new layer. A hint says what the attacker tries next.
Attack through a document
“Email with an instruction”: the bot processes a customer email that contains an “internal instruction” to issue a refund and keep quiet.
Watch the log
Which layer checked what, what the model saw and why it obeyed. The “Attack regression” tab shows the whole picture at once.
No paid neural networks
The bot isn’t a neural network but a deterministic imitation of a gullible model: this way every attack reproduces the same way, and tests check the defenses without paid requests. The defense layers are ordinary code that sits in front of a real model in a production project. The main takeaway matches OWASP: secrets don’t belong in the prompt, and tool permissions are checked by code.
The demo runs without OpenAI, YandexGPT or GigaChat API keys. Wherever a production system calls a model, there’s a local stub with the same interface — so the demo is free, always available and never makes things up.
What a production project adds
- An audit of the bot or agent: what data and tools it can access and what happens if it’s tricked
- Defense layers in front of the model: input and output filters, data separation, limits
- Tools with least privilege and human confirmation — for money and personal data
- An attack suite in CI: every prompt change or model switch is checked against old bypasses
Stack
- All demos by stack:
- Vanilla JS
- JavaScript without frameworks
- Unicode NFKC
- Base64
- OWASP Top 10 for LLMs
- Vitest
- Playwright
- Vite
Based on
Books and university courses whose ideas are at work in this demo.
Book · Fan Wenjie, Li Jianchao, Yan Xiaofan, Zhang Bin
Vibe Coding: Software Development in the Age of AI
All attacks run against all protection levels in Vitest and Playwright tests: whatever the model generated, regressions are caught by the tests.
Book · Bruce Schneier
A Hacker’s Mind
An attack trainer for a support bot: 15 attacks, indirect injections through emails and reviews, six protection levels based on the OWASP Top 10 for LLM.
Book · Charles Petzold
Code: The Hidden Language of Computer Hardware and Software
Attacks through base64, invisible characters and look-alike Latin letters: the defence first normalises the text (Unicode NFKC).
Developer’s comment
Anton Goncharov
AI systems developer · Python
For business
- A bot with access to money and data is a new attack surface. The trainer shows with clear examples what can happen.
- The main rule: money and personal data — only with human confirmation or a check in code.
- Testing a bot before launch is cheaper than dealing with a leaked promo code afterwards.
For developers
- The model here is a deterministic imitation of a gullible model, so every attack reproduces identically and becomes a regression test.
- Defense layers: normalization of Unicode and invisible characters, attack patterns, separation of instructions and data, tool permissions, an output filter, a canary token and an attempt limit.
- The “attacks × levels” table is checked by Vitest and Playwright on every build.
Tips
Tip 01
Don’t store secrets in the system prompt — sooner or later someone will extract it.
Tip 02
Check tool permissions in code against the user, not against the text the model sent.
Want the same for your business?
Tell me about your task — I’ll tell you what from the demo fits, how long it will take and what I’ll need from you.
Other demos in this section
All demos- live
Web app · agent diagram
AI agent builder
A support agent is assembled from blocks: intents, a knowledge base, API calls, checks and operator handover. Send a customer message and watch its path light up on the diagram step by step.
- React
- TypeScript
- live
Web app · question → SQL → chart · PostgreSQL in the browser
AI data analyst
A manager asks in plain words — “revenue by channel for Q3”, “which customers stopped ordering” — and gets SQL, a chart, a table and a conclusion. The sales database is real PostgreSQL running right in the browser.
- React
- TypeScript
- live
Web app · risks against a standard · Word with tracked changes
Contract review
A counterparty sent their own contract — the review compares it with the company’s standard, highlights risky clauses, explains why they’re dangerous and suggests wording. The output is a Word file with tracked changes and a disagreement protocol.
- React
- TypeScript
- live
Web app · tasks from chat · kanban · evening digest
AI agent in a team chat
People write in the team chat as usual — “Pete, fix the price list by Friday”. The agent creates a task on the kanban board, moves it through “On it” and “Done”, reschedules and reassigns tasks, reminds about overdue work in the morning and sends a digest in the evening.
- React
- TypeScript
- live
Web app · shared inbox · CRM · protection against bank detail fraud
AI inbox triage
The agent reads the sales team’s shared inbox: it understands what each email is, extracts fields, creates a deal, a ticket or a task in the CRM and drafts a reply. An invoice with new bank details or a phishing email is caught before anyone pays or clicks a link.
- React
- TypeScript
- live
Web app · marketplaces · moderation check · unit economics
Product listings for WB and Ozon
The agent turns a supplier’s text into two listings — for Wildberries and for Ozon: a title within the marketplace limit, a description with search keywords, attributes from the reference lists. Then it checks what listings usually fail moderation on and calculates what’s left from each sale.
- React
- TypeScript
- live
Web app · meeting transcript · minutes · kanban
Meeting minutes → kanban tasks
The agent reads a stand-up transcript and builds the minutes: decisions, tasks with an assignee and deadline taken from live speech, risks and open questions. Tasks go to the kanban board, and at the next meeting the agent moves them through statuses itself.
- React
- TypeScript
- live
Web app · personal data · healthcare · analytics
Anonymizing data before it reaches a neural network
The agent finds full names in any grammatical case, phones, passports, SNILS numbers, cards, addresses and diagnoses in emails and transcripts, replaces them before sending to an external neural network, and restores its answer to the real data on your side. It anonymizes a patient table for analytics so that nobody can be identified.
- React
- TypeScript
- live
Web app · automation · amoCRM, 1C, Telegram
An n8n-style automation pipeline
Three working scenarios of a furniture factory on a canvas, as in n8n: website leads go to amoCRM and to managers by lead temperature, YooKassa payments go to 1C with retries and an error branch, and every morning there’s a digest for the director. Trigger an event and watch records flow from node to node; the workflow can be edited and exported to real n8n.
- React
- TypeScript
- live
Web app · multi-agent system · content
A team of AI agents for content
Six agents prepare a publication from a brief: the editor-in-chief plans, the researcher finds facts in the knowledge base, the writer writes, the fact-checker and editor send the draft back for revision, and the SMM agent adapts the text for Telegram, VK, a newsletter, a blog and a carousel. You see the agents’ entire conversation, every edit and what would have been published without checks.
- React
- TypeScript
- live
Web app · HR · scoring and chatbot
CV screening and an interviewer bot
Twenty CVs for three vacancies are analyzed in seconds: employment periods, experience, salary and city, match with the requirements and a quote from the CV for every “yes” or “no”. What’s missing from the CV is clarified by a bot: it asks only the missing questions, follows up on vague answers and books an interview. Gender, age and family are left out of the assessment.
- React
- TypeScript
- live
Web app · RAG · neural network in the browser
Search sandbox
How a support bot finds an answer in a knowledge base: documents are cut into fragments, search runs by keywords, by meaning or as a hybrid, and every fragment found shows why it ranks above the others.
- React
- TypeScript
- In-browser neural network
- live
Web app · metrics · CI thresholds
Bot quality evaluation
Before a new bot configuration is rolled out, it’s run against control questions. Here you can see how that works: hit@1, hit@3, the share of correct refusals, a comparison with production and a red banner if CI would block the release.
- React
- TypeScript
- In-browser neural network
- live
Web app · AI economics · vanilla JS
AI bot cost calculator
How much a bot will cost per month on GPT, Claude, YandexGPT, GigaChat or your own model on a rented GPU. Token-based calculation, all models compared on a chart, tips on paying less, and a real o200k tokenizer right in the browser.
- Vanilla JS