HouYi
HouYi is a free, open-source, self-hosted framework for automating prompt-injection attacks against applications that use large language models.
What HouYi is
HouYi is a free, open-source, self-hosted framework for automating prompt-injection attacks against applications that use large language models. The repository includes framework code and a demonstration script that imitates an English-to-French translation app; the sample injection adds “Pwned!!” to replies. To examine another application, users create a harness that communicates with the target, returns its response, and supplies an attack intention. A BotSonic harness example for WriteSonic is included. HouYi is based on GPT and requires an OpenAI API key in its configuration. Setup requires installing the listed requirements and using Python 3.8 or later. The project identifies its license as Apache-2.0. Its associated paper reports testing 36 real LLM-integrated applications, with 31 found susceptible to prompt injection, and discusses mitigation tactics. The README asks research users to cite the paper and lists contributor contact emails.
Good
- Free Apache-2.0 open source
- Automated prompt-injection testing
- Custom harnesses and attack intentions
- Demo script included
- BotSonic integration example
Watch out
- Requires an OpenAI API key
- Requires Python 3.8 or later
- Target integrations need custom harnesses
- No continuous monitoring
Who it suits
It suits researchers and security practitioners examining prompt injection in LLM-integrated applications. Users should be comfortable with self-hosting, Python setup, API-key configuration, and writing application harnesses.
Verdict
HouYi provides a focused framework for researching prompt injection against LLM applications. Its self-hosted workflow is flexible, but meaningful testing requires technical setup and custom integration code.
The facts
Each one read from HouYi's own pages, with the date it was checked.
What it does
- Attack method
- The paper describes HouYi as a black-box prompt injection technique using a pre-constructed prompt, an injection prompt that induces context partition, and a malicious payload.checked 8 Oct 2026
- Contributor contact
- The README lists contributor email addresses for Yi Liu and Gelei Deng.checked 8 Oct 2026
- Custom targets
- Users can target real-world LLM-integrated applications by writing their own harness and attack intention.checked 8 Oct 2026
- Demo
- The included demo simulates an English-to-French translation application and demonstrates an injection that appends “Pwned!!” to responses.checked 8 Oct 2026
- Example integration
- The repository includes a BotSonic harness example for WriteSonic.checked 8 Oct 2026
- Harness
- A harness interacts with the target application and returns its response to a prompt injection.checked 8 Oct 2026
- Intended users
- The README asks users who use the code in research to cite the associated paper, “Prompt Injection attack against LLM-integrated Applications.”checked 8 Oct 2026
- License
- The repository identifies its license as Apache-2.0.checked 8 Oct 2026
- LLM dependency
- The README says HouYi is based on GPT and requires an OpenAI API key in its configuration file.checked 8 Oct 2026
- Mitigation context
- The paper says its investigation discusses possible tactics for mitigating prompt injection risks.checked 8 Oct 2026
- Model requirement
- The README says HouYi is based on GPT and requires an OpenAI key in its configuration to use it.checked 8 Oct 2026
- Purpose
- HouYi is an automated prompt injection framework for LLM-integrated applications.checked 8 Oct 2026
- Research finding
- The paper reports testing HouYi on 36 real LLM-integrated applications and finding 31 susceptible to prompt injection.checked 8 Oct 2026
- Research package
- The repository provides source code for the framework and a demo script that simulates an LLM-integrated application.checked 8 Oct 2026
- Setup
- The README says to install the requirements and have Python 3.8 or later.checked 8 Oct 2026
- Support
- The README lists contributor contact emails for Yi Liu and Gelei Deng.checked 8 Oct 2026
Where it runs
- Custom applications
- Users can target real-world LLM-integrated applications by writing their own harness and attack intention.checked 8 Oct 2026
- Integration approach
- A user-created harness must implement interaction with the target LLM-integrated application and return its response.checked 8 Oct 2026
Alternatives to HouYi
- 1
OpenSecureAI Scanner
Free planOpen sourceWebAPILinuxmacOS8.1From $49 a month - 2
AgentSeal
Free planOpen sourceWebAPILinuxmacOS8.0From $19 a month - 3
Promptfoo
Free planOpen sourceWebAPILinuxmacOS7.8Free plan - 4
Giskard
Free planOpen sourceWebAPILinuxSelf-hosted7.6Free plan - 5
Confident AI
Free planWebAPISelf-hosted6.9From $200 a month - 6
NVADER
Free planWeb6.7From $49 a month