Prompt Injection Testing
Prompt injection testing is where LLM security gets practical: system prompt pressure, tool misuse, RAG poisoning, indirect instructions, data leakage, and policy confusion.
Paste the prompt, response, log, or app behavior. F.R.A.N.Khelps turn the signal into a finding, fix path, or better test.
Reviewed July 4, 2026
Operator Brief
Use this like a working session, not a reading assignment. Paste the trace, name the target, and turn the loose pieces into a next move you can defend.
What F.R.A.N.K keeps in view
Turns prompt injection questions into repeatable tests with expected behavior.
Reads signals from logs, prompts, retrieved content, responses, and tool behavior.
Connects findings to fixes, validation criteria, and the boundary that failed.
Ingress
Prompt injection work gets real when you can point to the door: user input, retrieved document, email body, tool output, browser content, support note, or memory.
A source map that separates trusted instructions from untrusted content and names the exact boundary that failed.
Blast radius
F.R.A.N.K keeps the test tied to consequence: data exposure, tool misuse, decision drift, policy confusion, user-visible output, or hidden workflow corruption.
Impact language that is specific enough for engineering to prioritize without turning into fear marketing.
Repair
Instead of 'prompt injection is bad,' F.R.A.N.K frames mitigations around isolation, quoting, tool permission, retrieval sanitation, allowlists, and post-call validation.
A retest recipe with the hostile instruction, safe expected behavior, logs to capture, and the control that should block it.
Actual Use
Paste the prompt, response, retrieved text, tool call, log excerpt, or app behavior that shows the instruction boundary failing.
Trace whether the issue is scope, retrieval, tool permissions, instruction handling, output filtering, or validation.
Turn the observation into a finding with impact, reproduction context, control advice, and retest criteria.
Questions
Instructions slipped into content the model retrieves or reads, such as pages, documents, emails, or tool outputs, rather than the user message. The risk appears when the system fails to separate trusted instructions from untrusted content.
Jailbreaking targets the model's policy behavior. Prompt injection targets the application around the model: system prompts, retrieval, tools, and the boundary between instructions and data.
F.R.A.N.K helps shape test ideas from observed behavior and connect findings to remediation. It is not a payload library.