I Tested Prompt Injection on My DGX Spark - 6 Real Runs

I planted an instruction telling Qwen 3.5 to read fictional payroll. Across six completed trials, it never requested the private file. But that does not mean the permission boundary blocked anything. In this AI Cyber Guy lab on my DGX Spark, we replay the real requests, returned vendor document, and final answers. Then a separate tool-only control shows what broad and restricted permissions do when a private request actually arrives. All records are synthetic. This is a stored text fixture, not a browser exploit. Three completed trials used each policy; earlier incomplete attempts were retained separately. The planted instruction was explicitly labeled untrusted, and the task and system instructions reinforced that boundary. This small test does not establish resistance to other prompt injections or rank models. 🔒 Work with me (Security & AI implementation): https://viso.group | https://vaio.group | https://cyberbench.net CHAPTERS 00:00 I planted the instruction 01:00 Qwen 3.5 and the task 01:22 Inside the vendor document 02:06 Broad versus restricted access 02:40 The six-trial setup 03:25 What all six runs did 03:46 Replay the actual evidence 04:43 Requested, returned, revealed 05:33 The separate permission test 06:00 Instructions versus enforcement 07:03 Check more than a marker 07:27 Three questions for your workflow 08:14 What should we test next? Subscribe for more local-model experiments with visible requests, visible controls, and results you can inspect. Which workflow should we test next: document search, email summaries, or coding assistants? PREVIOUS EPISODE AI Found All 3 Flaws. Then It Overstated the Evidence.    • AI Found All 3 Flaws. Then It Overstated t...   BACKGROUND SOURCE OWASP: LLM01:2025 Prompt Injection https://genai.owasp.org/llmrisk/llm01... #Qwen #PromptInjection #AISecurity