A full writeup of our Tier 0 prompt-injection CTF. Filters and model instructions stand between you and its classified codename. Each control falls to a different, cheap technique.
Skip reading about how Gandalf-style guardrails work and build one yourself. A free, offline Python lab using Ollama that implements all eight defense patterns from this series, ready for you to attack.
The final Gandalf levels stack every defense and then harden them with data from a million real attacks. They're beatable too, and that's the most important lesson in the whole series.
Levels 4–6 replace dumb string filters with LLM-as-judge guards on the input and output. Smarter, harder, and still beatable with indirection. Here's how, and what the actual guard code looks like.
The first three Gandalf levels take you from "just ask" to defeating a deterministic output filter with encoding. A hands-on tour of the weakest LLM guardrails and why they fold.
Lakera's Gandalf is the best on-ramp to prompt injection ever built. Here's the full defense taxonomy behind its levels, and why none of it is enough on its own.