Schrute CTF
Can you outsmart Dwight? Learn how prompt injection and over-privileged chatbots lead to data leaks.
How It Works
Chat with Dwight
Each level features a chatbot with different security flaws. Find the vulnerability!
Extract the Secret
Use prompt injection techniques to trick the bot into revealing the password.
Capture the Flag
Submit the flag to prove you've learned the security lesson. Level up!
8 Levels of Security
Level 1
The Receptionist
EasyLevel 2
The Assistant (to the) Regional Manager
EasyLevel 3
Records Manager
MediumLevel 4
Risk & Communications Manager
MediumLevel 5
Voluntary Sherif
MediumLevel 6
Data Protection Operations Lead
HardLevel 7
Not Angela's Boyfriend
HardLevel 8
The Reflection Agent
ExtremeWhat You'll Learn
- ▸No Access Control: What happens when chatbots have unrestricted data access
- ▸Weak Obfuscation: Why hiding secrets in text doesn't protect them
- ▸Role-Play Bypass: How "pretend" prompts defeat safety measures
- ▸Logic Manipulation: Exploiting conditional behavior in bots
- ▸Encoding vs Encryption: Why Base64 isn't security
- ▸Prompt Injection: When user input becomes database commands
- ▸Log Leakage: How debug output exposes sensitive data
Frequently Asked Questions
What is prompt injection?▼
Prompt injection is a security vulnerability where attackers manipulate AI chatbots by inserting malicious instructions into user input. This can cause the AI to ignore its original programming, leak sensitive data, or perform unauthorized actions.
Is Schrute CTF free?▼
Yes! Schrute CTF is completely free to play. No sign-up required. Your progress is saved locally in your browser. We believe AI security education should be accessible to everyone.
Do I need coding experience?▼
No coding is required! The game teaches security concepts through natural language interactions. You'll learn by crafting clever prompts, not by writing code. It's perfect for beginners and experts alike.
How do I start playing?▼
Just click "Start Game" above! You'll chat with Dwight, our AI chatbot. Each level has a hidden secret. Your goal is to use prompt injection techniques to trick Dwight into revealing it. Submit the secret as a "flag" to progress.
Is this safe and legal?▼
Absolutely! Schrute CTF is a safe, sandboxed environment designed for educational purposes. You're practicing on our intentionally vulnerable chatbot—not real systems. It's legal and ethical hacking training.
Ready to Test Your Skills?
No sign-up required. Your progress is saved locally. Complete all 8 levels to become a prompt injection expert!