Gandalf launched in 2023 and became the most widely played prompt injection exercise on the internet. The idea is simple. An LLM knows a password and has been told not to reveal it. You try to get it out.
Level one gives it away if you ask. Each level after that adds another defence: a stricter system prompt, a filter on your input, a second model checking the output, and so on. By the later levels you are asking for the password spelled backwards, as a poem, or one letter at a time in a story. It works as teaching because of what happens by the end. You watch every defence layer get beaten by people with no special skills, and you understand why prompt injection is described as an unsolved problem rather than a bug.
I have used it with non-technical colleagues and it lands faster than any slide deck. The newer Agent Breaker challenges move the game onto agents that can call tools, which matters more now, since an agent that can send email or query a database is a much bigger prize than a password. There are two caveats I want to be clear about. The first is that Gandalf is a game. It never explains what the defences were, what the right architecture looks like, or how to limit damage when injection succeeds.
Played alone it can even teach the wrong lesson, that security is a contest of clever prompts. The real fix is limiting what the model can do and reach, which you learn from PortSwigger's Web LLM attacks labs or OWASP's LLM Top 10. The second is what happens to your prompts. Lakera has described Gandalf as one of the largest red teaming efforts around, with tens of millions of attack data points, and that data informs its commercial prompt protection product. Check Point agreed to acquire Lakera in September 2025 in a deal reported at around $300 million.
That is not sinister, and it is disclosed, but players should know they are contributing free labour to a commercial dataset. My take: a brilliant hour of learning and the best demo I know for why AI security is hard. Treat it as the hook, not the lesson.