Prompt injection sits at LLM01 in the OWASP Top 10 for LLM Applications — the single most exploited vulnerability class in deployed LLM systems. This page collects the best prompt injection resources practitioners actually rely on: runtime defenses, scanners, evaluation datasets, attack writeups, and the canonical reading list.
Two notes on scope. First, “prompt injection” here includes both direct injection (an attacker types adversarial input) and indirect injection (adversarial content reaches the model through retrieved documents, emails, tool outputs, or web pages). Indirect injection is the harder problem and most resources below address both. Second, no current defense is complete. The state of practice is layered controls: a runtime detector, an output validator, scoped tool permissions, and continuous evaluation. The resources below map to that layered model.
Runtime Defenses (Commercial)
| Tool | Latency | Coverage | Deployment | Pricing |
|---|---|---|---|---|
| Lakera Guard | < 50ms | Injection, jailbreaks, PII, content | API | Per-call, free tier |
| Prisma AIRS Model Security (formerly Protect AI Guardian) | Not published | Injection, model scanning, supply chain | API, on-prem | Enterprise |
| Mindgard | Async (CART) | Continuous testing + runtime | API, CI/CD | Enterprise |
| Amazon Bedrock Guardrails | Native | Injection, content, PII, grounding | AWS native | Per-call |
| Azure AI Content Safety — Prompt Shields | Native | Injection, jailbreak | Azure native | Per-call |
Lakera Guard — Pros: lowest-friction integration, very competitive PINT benchmark scores, strong threat intel feed. Cons: SaaS dependency; some teams prefer self-host for sensitive data.
Prisma AIRS Model Security (formerly Protect AI Guardian) — Pros: covers model file scanning and supply chain, not just runtime; broader coverage of the AI security surface. Cons: heavier integration than a single guard endpoint, and the product now sits inside a Palo Alto Networks platform relationship rather than a standalone one.
Mindgard — Pros: combines continuous adversarial testing with runtime defense, useful for catching regressions in fine-tunes. Cons: best fit for teams with mature CI/CD; overkill for single-deployment shops.
Bedrock Guardrails / Azure Prompt Shields — Pros: native to their respective clouds, minimal operational overhead, IAM-integrated. Cons: detection rates lag specialized vendors; lock-in to one cloud.
Runtime Defenses (Open Source)
| Tool | Maintainer | Stars (approx) | Strength |
|---|---|---|---|
| LLM Guard (archived July 2026) | Protect AI | 1.5k+ | Modular input + output scanners, no longer maintained |
| Rebuff | Protect AI | 1.2k+ | Multi-layer canary token approach |
| PromptGuard / Llama Guard | Meta | 4k+ | Open weights, classifier-based |
| NeMo Guardrails | NVIDIA | 4k+ | Programmable rails, broader scope |
| Vigil-LLM | Adam Swanda | 400+ | Local scanners with YARA rules |
LLM Guard — the repository was archived in July 2026 and its Hugging Face models are no longer maintained, so it no longer belongs in a new deployment. The modular design is still worth reading, but a frozen classifier in a security path degrades as attacks move. Self-hosted replacements: Llama Prompt Guard 2 open weights, or NeMo Guardrails where you need policy rails as well as classification.
Rebuff — Pros: clever canary token technique catches some attacks specialized detectors miss. Cons: smaller maintainer community, slower release cadence.
PromptGuard / Llama Guard — Pros: open-weight classifiers from Meta; can be self-hosted on your GPU. Cons: classifier accuracy varies by attack class; benchmark before relying on it.
NeMo Guardrails — Pros: powerful Colang DSL for declarative safety policies; goes beyond injection into broader conversation safety. Cons: learning curve; for pure injection use cases simpler tools may fit better.
Use when: you can’t ship sensitive prompts to a SaaS, you need full control over detection logic, or you’re integrating into an air-gapped deployment.
Scanners and CI/CD Integration
For pre-deployment and continuous testing.
| Tool | Type | Use Case |
|---|---|---|
| Garak | CLI scanner | Probe library against any model endpoint |
| Promptfoo | Eval framework | Red team test suites, CI-friendly |
| PyRIT | Framework | Automated red teaming, Microsoft-maintained |
| Giskard | Scanner | LLM behavioral tests, leaderboards |
| DeepEval | Test framework | Pytest-style LLM evals incl. injection |
Garak — Pros: the canonical OSS LLM vulnerability scanner; NVIDIA-maintained; broad probe library. Cons: scan duration can be long on slow APIs; budget time.
Promptfoo — Pros: very ergonomic for engineering teams; YAML test configs; runs in CI. Cons: more eval-focused than red-team-focused — pair with Garak for adversarial coverage.
PyRIT — Pros: Microsoft’s automated red teaming framework with attack strategy primitives; well-suited to research and advanced teams. Cons: steeper learning curve than Promptfoo.
Use when: you want injection regressions to fail CI before deploys; you’re publishing benchmark numbers; you’re building an internal “AI sec gate” between model changes and production.
Datasets and Benchmarks
| Dataset | Size | Purpose |
|---|---|---|
| PINT Benchmark | ~3,000 prompts | Detector benchmarking |
| JailbreakBench | 100 behaviors | Standardized jailbreak eval |
| HarmBench | 510 behaviors | Red team evaluation framework |
| PromptBench | Various | Robustness to adversarial prompts |
| TensorTrust | Crowd-sourced | Attack/defense pairs from a public game |
PINT is the reference benchmark when comparing detector products. JailbreakBench is the standard for evaluating jailbreak resistance, with judge models included. TensorTrust is uniquely valuable for diversity — the prompts came from real adversarial play, not synthetic generation.
Use when: you’re publishing detection numbers, comparing two vendors apples-to-apples, or stress-testing a defense before procurement signoff.
Foundational Reading
The minimum reading list. If you only have time for four, read the bolded entries.
| Resource | Type | Why |
|---|---|---|
| Greshake et al. — Not What You’ve Signed Up For | Paper | The paper that named indirect prompt injection |
| Simon Willison’s prompt injection archive | Blog | The single best ongoing chronicle |
| OWASP LLM01: Prompt Injection | Standard | The vocabulary your team will use |
| Lakera — Prompt Injection Attacks Handbook | Practitioner guide | Taxonomy of injection patterns |
| Anthropic — Many-shot jailbreaking | Research | Long context = new attack class |
| Microsoft — Mitigating prompt injection in production | Industry post | Defense-in-depth recipes |
| NIST AI 600-1 §2.5 | Government guidance | Regulatory framing of injection risk |
Skip if the article was written before 2023 — the attack landscape has shifted enough that pre-2023 writing is mostly historical context.
Communities and Learning
| Venue | Format | Best For |
|---|---|---|
| Lakera Gandalf | Interactive game | Beginner hands-on |
| DeepLearning.AI — Red Teaming LLM Applications | Free course | Structured intro |
| AI Village CTFs | Conference events | Advanced practice |
| OWASP GenAI Slack | Async chat | Direct access to standards authors |
| DEF CON Generative AI Red Team Village | Annual | Live red team exercises |
Sibling Site Coverage
For deeper context on related defenses and attack tracking:
- aisecreviews.com — Reviews of Lakera, Protect AI, Mindgard, and other listed tools
- jailbreakdb.com — Catalog of known jailbreak techniques
- jailbreaks.fyi — Live tracker of novel jailbreaks
- bestllmscanners.com — Scanner comparison data
- guardml.io — Open-source guardrail patterns
- aiincidents.org — Real-world prompt injection incidents
Our companion guides on this site:
- AI firewall and guardrail solutions
- Open-source LLM security testing
- AI red teaming tools
- How to detect prompt injection vulnerabilities — bestllmscanners.com
- Best LLM vulnerability scanners 2026 — bestllmscanners.com
This page is the resource directory for prompt injection: what to install, what to read, what to benchmark against. It deliberately does not duplicate the broader AI security resources hub (courses, certifications, communities) or the AI security articles reading list.
Decision Guide
Building a new LLM feature, no existing defenses: start with Lakera Guard at the API boundary plus Garak in CI. Read the OWASP LLM Top 10 and Greshake paper before you write your threat model.
Already running on AWS/Azure: turn on Bedrock Guardrails / Azure Prompt Shields as a baseline, then layer Lakera Guard or a self-hosted Llama Prompt Guard 2 on top for the gaps native services don’t cover.
OSS-only, air-gapped: Llama Prompt Guard 2 open weights (or NeMo Guardrails where you need policy rails too) + Garak. Plan for tuning time.
Mature program seeking continuous coverage: Mindgard or Prisma AIRS for CART; Promptfoo or PyRIT in CI; quarterly Garak full scans; subscribe to Simon Willison’s RSS for technique drift.
How This List Is Maintained
This page is reviewed in February, May, August, and November. Entries are removed if a tool has not shipped a release in 12 months, if external links break beyond a single quarter, or if independent testing shows materially worse performance than at the time of listing. New entries qualify after the tool’s own documentation has been checked against what it claims.
Related across the network
- Lakera Guard: Prompt Injection Detection in Practice — aisecreviews.com
