Primary sources only — the issuing body, the maintainer's repository, the researcher's own site. Nothing here links to a summary of something else. Reviewed 24 Sep 2026
The shared vocabulary. Start here if you need to map an internal finding onto something an auditor recognises.
Practitioner writeups of how these attacks actually work. Where you go after the taxonomy tells you a category exists and you need to understand the mechanism.
Maintained, installable tools. These are where working test corpora legitimately live — see the note at the foot of this page.
Reference corpora for measuring whether a defence actually holds, rather than asserting that it does.
Authoritative feeds. The CVE section of this site draws from the first of these.
Six classes, each with the mechanism and what it means for your own testing. These describe how a class of attack functions and what to check in your own system — they are not a payload collection.
Mechanism. The attacker is the user. Instructions are typed straight into the input the application forwards to the model, aiming to override the system prompt.
What to test for. Whether authority is re-derived from model output anywhere downstream, and whether the system prompt is treated as a security boundary it cannot be.
Mechanism. Instructions arrive through a channel the deployment retrieves on the model's behalf — a document, a web page, a tool response, an email body — and are never seen by the user.
What to test for. Every path that can place tokens in a context window. Most deployments defend the input box and trust the retrieval path completely.
Mechanism. A tool or connector the agent calls returns attacker-influenced content, which the agent then treats as trusted context for its next decision.
What to test for. Whether tool output re-enters the context with the same standing as the system prompt, and whether the agent's authority is bounded per call rather than per connection.
Mechanism. The payload is encoded, split, translated or embedded in another modality so that a filter matching on surface form does not recognise it while the model still acts on it.
What to test for. Whether your defence matches on text patterns. If it does, this class is the reason it will not hold.
Mechanism. No single turn is adversarial. Context is built incrementally across a conversation until the model's state permits what a single request would have been refused.
What to test for. Whether anything evaluates the conversation rather than the request. Per-request checks are blind to this by construction.
Mechanism. Crafted queries induce the model to emit its system prompt, retrieved context belonging to another tenant, or memorised training data.
What to test for. Whether anything inspects the response. Entitlement to ask is not entitlement to receive, and this class only shows up at egress.
On working payloads. This site deliberately does not host a library of ready-to-run jailbreak or injection strings. Not because the information is secret — it plainly is not — but because a payload list rots within weeks as models change, gives a false sense of coverage when it passes, and is worse at the job than the maintained tools that exist for it.
If you want to actually test a system, use the corpora that are kept current: garak, PyRIT, promptfoo and JailbreakBench are all linked above. Test against your own deployment, with authorisation.