Prompt Injection
Protection

More and more clients are asking for applications that use large language models. Avanade needed clearer, practical information on how to keep those systems secure so delivery teams can meet client expectations and build trust. A core risk is prompt injection: hidden instructions in user input or other context can make a model ignore its task, leak data, or misuse tools.

That risk is especially serious when the model calls APIs or MCP MCP Model Context Protocol: an open way to connect LLMs to tools and data (often via small servers). When a model can call out like this, prompt-injection failures can reach real systems. Model Context Protocol -style servers, because failures can propagate into real systems and client environments. There is still a gap between theory and clear, repeatable attack examples.

Teams need practical ways to learn how attacks work, what mitigations exist, how to run tests, compare mitigations, and harden system prompts without breaking intended behaviour. Abstract guidance alone is not enough: teams also need readable material on vulnerabilities and mitigations and a way to run prompts against real models and review what comes back.

We built an educational web application with a React single-page front end and a FastAPI back end backed by SQLite. Users can work through a vulnerability catalogue with detail pages and interactive demos, take quizzes to check what they have learned, and open a mitigation catalogue when they need practical fixes—mitigation pages give structured explanations and optional code-style snippets.

A knowledge assistant Knowledge assistant Catalogue-aware chat: answers on prompt injection and the platform, with suggested questions—not a general web search. answers questions about prompt injection in plain language, with keyword search across the catalogue. The testing area lets you run your own prompts against whichever models you configure (including custom endpoints). You can also run Garak Garak NVIDIA’s open-source Generative AI Red-teaming & Assessment Kit: a probe-based scanner for LLMs that checks for prompt injection, jailbreaks, leaks, and other failure modes, similar in spirit to security tools like nmap but for language models. NVIDIA Garak on GitHub scans against those same models, with chat-style output and a short risk read-out. The prompt enhancer Prompt enhancer Three steps: improve your system prompt, add mitigation rules you choose, verify—before the model uses it. walks through three steps on your system prompt—tidy it up, add mitigation rules, check the result—before you rely on that prompt in production.

On the server side, traffic goes through one routing layer to the right provider APIs; SQLite stores the catalogue, saved tests, and past runs; optional mitigation layers can sit around each test run; and simple scoring flags outputs that look risky. A small runner calls the external Garak tool and drops those scan results into the same history and analysis views as manual tests. The assistant streams answers live, like a chat, so replies appear as they are generated.

Developed in collaboration with Avanade, the platform is for anyone at the company—whether they are new to prompt injection or already pushing deeper tests with custom models. It supports people at any stage of familiarity, in a digestible format, as both an interactive learning space and a hands-on testing environment.

The aim is for teams to align on risk and rehearse mitigations before problems surface in client systems, and so people have tried mitigations, not just read about them. In turn, that can strengthen client trust, raise capability across technical and non-technical roles, and give Avanade a lasting internal resource that stays useful as models and tools change.