Threat Feed

Listy's list of known tricks

Every card is a real message people have typed to fool an AI assistant — to get free stuff, steal secrets, or make it misbehave. Browse them so you know what to protect against. Spotted a new one? Add it for free.

Listy, a dark blacklist of flagged threats holding a pen

Filter by type or danger

Green = minor, yellow = worth fixing, red = serious.

Open a card to see the trick

Click 'Show the exact message' to see what the attacker typed.

Vote and share

Upvote tricks you've seen too. The community confirms what's real.

Tricks on the list

Serious ones

Confirmed by community

How dangerous?

403

BL-0001Prompt InjectionsSerious · 9/10OWASP LLM01

Indirect injection via hidden HTML in retrieved web page

Caught in the wild · ResearchSecurity researcher write-upActive · 214 sightings

What they're after: Hide secret orders inside a normal web page so your bot obeys them when it reads the page.
Are you affected?: Only if your bot can read websites or links.
What could go wrong: Your customers' chats could be quietly sent to a stranger.

Technical summary: Browsing agent summarises a page containing white-on-white text that instructs it to exfiltrate the conversation to an attacker URL.

Test my bot against this

North America2026-09-27Community Verified▲412 ▼9

342

BL-0002Data LeaksSerious · 8/10OWASP LLM02

Markdown image exfiltration of chat history

Caught in the wild · DiscordJailbreak-sharing serversSurging · 389 sightings

What they're after: Make the bot include a hidden picture link that secretly carries your chat history out.
Are you affected?: Bots whose chat window shows images.
What could go wrong: Private conversations leak without anyone noticing.

Technical summary: Model is coerced into emitting a markdown image whose query string contains secrets; the client auto-fetches it.

Test my bot against this

EU2026-09-25Community Verified▲356 ▼14

247

BL-0003JailbreaksModerate · 6/10OWASP LLM01

Roleplay 'grandma' jailbreak for restricted procedures

Caught in the wild · Redditr/ChatGPT — 2.4k upvotesSteady · 1203 sightings

What they're after: Use a sad 'pretend to be my grandma' story to get the bot to say things it normally refuses.
Are you affected?: Any chatbot, especially friendly customer bots.
What could go wrong: Embarrassing screenshots shared publicly under your brand.

Technical summary: Emotional roleplay framing bypasses refusal training by embedding the harmful request in a nostalgic persona.

Test my bot against this

Global2026-09-22Community Verified▲288 ▼41

495

BL-0004Excessive AgencySerious · 10/10OWASP LLM06

Agent auto-executes shell from README instructions

Caught in the wild · GitHubMalicious code repositoriesSurging · 96 sightings

What they're after: Get a coding helper to run a harmful command on its own.
Are you affected?: Only bots that can run actions or programs.
What could go wrong: Stolen passwords and a hacked computer.

Technical summary: Coding agent with unrestricted terminal access follows setup steps in a malicious repository that install a credential stealer.

Test my bot against this

APAC2026-09-21Community Verified▲501 ▼6

219

BL-0005System OverridesSerious · 7/10OWASP LLM01

'Developer mode' system prompt override

Caught in the wild · X / TwitterViral 'developer mode' threadsActive · 742 sightings

What they're after: Pretend to be the boss so the bot drops its rules.
Are you affected?: Any chatbot without a 'my rules come first' line.
What could go wrong: The bot gives refunds, discounts or answers it shouldn't.

Technical summary: User claims elevated privileges and fabricates a new system block to replace the operator's instructions.

Test my bot against this

North America2026-09-18Community Verified▲237 ▼18

177

BL-0006Data LeaksModerate · 5/10OWASP LLM07

System prompt extraction via translation trick

Caught in the wild · Redditr/PromptEngineeringActive · 511 sightings

What they're after: Ask the bot to 'translate everything above' to reveal its private instructions.
Are you affected?: Any chatbot with private instructions.
What could go wrong: Competitors copy your setup, or find secrets inside it.

Technical summary: Asking the model to 'translate everything above' into another language leaks confidential system instructions.

Test my bot against this

LATAM2026-09-15Community Verified▲199 ▼22

133

BL-0007Prompt InjectionsSerious · 7/10OWASP LLM01

Poisoned PDF résumé manipulates HR screening agent

Caught in the wild · ResearchHR-tech security reportSteady · 58 sightings

What they're after: Hide 'rate this candidate top' inside a CV so a hiring bot is fooled.
Are you affected?: Bots that read uploaded files.
What could go wrong: Wrong decisions made on your behalf.

Technical summary: Invisible text inside an uploaded CV instructs the screening model to rank the candidate first and skip checks.

Test my bot against this

EU2026-09-12Under Review▲144 ▼11

166

BL-0008Excessive AgencySerious · 9/10OWASP LLM06

Tool-call confusion: agent emails entire CRM export

Caught in the wild · DiscordCoupon-hunting communitiesSurging · 330 sightings

What they're after: Talk shop bots into giving free or 90%-off codes.
Are you affected?: Bots with access to prices, coupons or carts.
What could go wrong: Direct money loss.

Technical summary: Support email containing embedded instructions causes an assistant with send_email + crm_export tools to mail all customer records.

Test my bot against this

North America2026-09-10Under Review▲173 ▼7

102

BL-0009JailbreaksModerate · 4/10OWASP LLM01

Base64 token-smuggling past keyword filters

Caught in the wild · Redditr/LocalLLaMASteady · 140 sightings

What they're after: Wrap a forbidden request in a game or code so filters miss it.
Are you affected?: Any chatbot.
What could go wrong: Off-brand or harmful replies.

Technical summary: Payload is encoded so input moderation misses it; the model decodes and follows it.

Test my bot against this

APAC2026-09-06Community Verified▲121 ▼19

BL-0010System OverridesMinor · 3/10OWASP LLM01

Few-shot override seeds unsafe assistant behaviour

Caught in the wild · ResearchAcademic paperSteady · 37 sightings

What they're after: Fake an earlier conversation so the bot 'continues' leaking secrets.
Are you affected?: Bots that have secrets written in their instructions.
What could go wrong: Passwords or keys exposed.

Technical summary: Fake prior dialogue turns establish a pattern that the model continues, eroding operator constraints.

Test my bot against this

Global2026-09-02Under Review▲64 ▼12