Security education usually fails because it is delivered as rules. Do not do this, always do that, here is a list of vulnerability categories. People read it, nod, and build the insecure thing anyway, because they never developed the instinct for how an attacker thinks. The rare exception is education that puts you in the attacker's position, and Gandalf does that for prompt injection better than anything else I have found.
The game is simple in structure. There is a language model holding a password, and increasingly elaborate defences preventing it from revealing it. Your job is to get the password out. Early levels fall to a direct request.
Later ones require indirection, roleplay, encoding tricks, exploiting the gap between what the defence checks and what the model does, and by the end you are constructing attacks that would not have occurred to you an hour earlier. That progression is the entire educational value and it cannot be replicated by reading. The lesson that lands hardest is that prompt based defences are porous. A great many teams currently protect their applications by telling the model not to do things, and this is still a widespread belief among people who should know better.
An hour with Gandalf demonstrates the problem more convincingly than any amount of argument. You watch yourself get past instruction after instruction, and the conclusion that instructions are not a security boundary becomes something you know rather than something you were told. I would put that hour ahead of most security reading for anyone building with these models. The accessibility deserves credit.
There is nothing to install, no account required and no cost. The barrier to a genuinely valuable security lesson is a browser tab, which is why I recommend it constantly and why it has reached so many people who would never have read a security paper. The written material around the game is competent vendor content. It covers prompt injection categories, data leakage, the general shape of the threat landscape and the current thinking on defences.
It is accurate and reasonably current and it is also written by a company selling security products, which shapes emphasis in the predictable direction. That is not a scandal, it is the nature of the format, and it means you should read it as a well informed perspective rather than a neutral survey. The game's limits matter. Gandalf is a constrained puzzle with a single objective and one interface.
Real applications have retrieval systems ingesting untrusted documents, tools with real permissions, multi turn conversations that accumulate context, and outputs consumed by other systems. Indirect injection through a retrieved document is arguably the more dangerous class of attack and the game does not represent it. Finishing the levels means you understand the concept, not that you have seen the attack surface. The defensive material is thinner than the offensive demonstration, which is the common shape of security education and is worth naming.
You come away vividly aware that prompt injection works and less clear about what to actually do. The real answers involve architecture rather than cleverer prompts, limiting what the model can do, treating its output as untrusted, keeping permissions minimal, separating instruction context from data context, and none of those get the same experiential treatment as the attacks. The overconfidence risk is real. An hour of a puzzle game is not a security education, and it is easy to finish feeling more capable than you are.
Someone who beats the levels and concludes they understand language model security will make architectural decisions they are not qualified to make. Treat it as an excellent introduction that motivates further work, not as the work itself. Four point one, and almost all of it is Gandalf. There are very few pieces of free educational content that change how people build things within an hour, and this is one of them.
The written material is useful and unremarkable, the defensive side is underdeveloped, and the core demonstration is good enough that I would recommend it to anyone putting a model anywhere near untrusted input.