Day 2 · AI & Cybersecurity · you run this one yourself, in this browser
Paste the key your instructor gives you. It is held in this browser tab only — it is never written to disk, never saved by this page, and goes nowhere except to OpenAI. Close the tab and it is gone.
api.openai.com and is held in this browser tab's memory only:
it is never sent to this website, never written to disk, never saved.
Close the tab and it is gone.<head>
for the Content-Security-Policy line: it pins
connect-src to https://api.openai.com, so the
browser will refuse to send a request from this page anywhere
else. That is enforcement, not a promise in a paragraph — which is a
distinction worth carrying into the rest of this course.
Five excerpts are built into this page — nothing to download. The sixth tile lets you feed it a log of your own.
Written by us, the developer. The model reads every word of this before it sees a single line of log. It is an ordinary editable box — change anything you like, then run the same log again and see what moved.
Everything below is DATA. We did not write it: it came out of a log file that anyone who can reach the login page can put text into.
Both blocks above become adjacent tokens in one flat context window. The model has no architectural way to tell our rules from the log's contents — that is the whole mechanism of prompt injection, and it is where Day 4 starts.
Choose a log first.
Every run you make is recorded here. Download it as Markdown to keep the transcript — the browser cannot write into a folder, so this lands in your Downloads.
No runs yet.