Prompt Heist is a playable, browser-based 2D ancient-fantasy adventure that teaches AI security by letting you play it. Travel an illustrated world map, walk your adventurer to a kingdom’s gate, and talk your way past guardians that protect fictional secrets.

The game

• 5 ancient kingdoms: Civic Grids, Bio-Archives, Trade Ports, Risk Ledgers and Scrap Wastes, each with its own look, guardian and domain.
• 6 levels per kingdom on the same difficulty ladder:
  1. The Friendly Guard
  2. The Reasoning Guard
  3. The Authority Checkpoint (checkpoint)
  4. The Game Master
  5. The Royal Clerk
  6. The Adaptive Boss
• Animated player character that walks along stone roads between locations.
• Strikes, checkpoint, victory and defeat screens.
• Security debrief after every level explaining the weakness the guardian showed and the real-world defence, for example claimed authority is not proof of identity and exact-string filters fail when representations change.

Why it matters

Prompt injection and jailbreaks are easier to understand when you try them in a safe, fictional setting. All secrets in the game are made up. Players are reminded to test only systems they own or have permission to test.

Tech

• React + Vite, plain JavaScript, React Router
• All art is original and drawn in code (inline SVG + CSS animation), with no external image assets
• API layer ready for a Python FastAPI backend and an open-weight Gemma model via Ollama
• Win detection is meant to be decided by the backend, never by the guard’s own text. The mock guardians in this prototype use simple keyword rules as a stand-in.