HouYi

Paid Self-hosted

What HouYi is

HouYi is a free, open-source framework for automating prompt injection attacks against applications that use large language models. It includes source code and a demo script that simulates an English-to-French translation app; the demonstration shows an injected prompt causing the app to append “Pwned!!” to its responses. To target another application, users need to create a harness that interacts with that application and returns its response, then provide an attack intention. The repository includes a BotSonic harness example for WriteSonic. HouYi is self-hosted, based on GPT, and requires an OpenAI API key in its configuration. Setup also requires installing the listed dependencies and Python 3.8 or later. The project identifies its license as Apache-2.0. Its associated paper reports testing the framework on 36 real LLM-integrated applications and finding 31 susceptible to prompt injection; the paper also discusses possible mitigation tactics. The README asks people using the code in research to cite the paper, “Prompt Injection attack against LLM-integrated Applications.”

Who it suits

HouYi is for developers and researchers examining prompt injection in LLM-integrated applications. Targeting an application requires writing a harness and supplying an attack intention.

What it does well

Automates prompt injection attacks.
Includes a demo script and a BotSonic harness example.
Apache-2.0 license.
The associated paper discusses mitigation tactics.

What to know first

Requires Python 3.8 or later and dependency installation.
Requires an OpenAI API key.
Users must build a harness for custom targets.

Limits

HouYi requires Python 3.8 or later and an OpenAI API key in its configuration. Custom testing also requires a user-created harness that interacts with the target application and returns its response.

Getting started

Open the HouYi GitHub repository
Install Python 3.8 or later
Install the repository requirements
Configure an OpenAI API key
Run the included demo script
Write a harness and attack intention for a custom target

Verdict

HouYi provides a self-hosted way to run prompt injection tests, with a demo and an example harness. Custom targets require integration work and an OpenAI API key.

Questions

Is HouYi free?

Yes. HouYi is free, open source, and identifies its license as Apache-2.0.

How is HouYi deployed?

HouYi is self-hosted.

What does HouYi test?

It automates prompt-injection attacks against LLM-integrated applications.

Does HouYi require an OpenAI key?

Yes. The framework is based on GPT and requires an OpenAI API key in its configuration.

Can HouYi target custom applications?

Yes. Users write a harness and attack intention for the target application; the harness returns its response.

What example is included?

The repository includes a demo of an English-to-French translation application and a BotSonic harness example for WriteSonic.

Facts from HouYi's own pages

Attack method: The paper describes HouYi as a black-box prompt injection technique using a pre-constructed prompt, an injection prompt that induces context partition, and a malicious payload. · arxiv.org, 8 Oct 2026
Contributor contact: The README lists contributor email addresses for Yi Liu and Gelei Deng. · github.com, 8 Oct 2026
Custom applications: Users can target real-world LLM-integrated applications by writing their own harness and attack intention. · github.com, 8 Oct 2026
Custom targets: Users can target real-world LLM-integrated applications by writing their own harness and attack intention. · github.com, 8 Oct 2026
Demo: The included demo simulates an English-to-French translation application and demonstrates an injection that appends “Pwned!!” to responses. · github.com, 8 Oct 2026
Example integration: The repository includes a BotSonic harness example for WriteSonic. · github.com, 8 Oct 2026
Harness: A harness interacts with the target application and returns its response to a prompt injection. · github.com, 8 Oct 2026
Integration approach: A user-created harness must implement interaction with the target LLM-integrated application and return its response. · github.com, 8 Oct 2026
Intended users: The README asks users who use the code in research to cite the associated paper, “Prompt Injection attack against LLM-integrated Applications.” · github.com, 8 Oct 2026
License: The repository identifies its license as Apache-2.0. · github.com, 8 Oct 2026
LLM dependency: The README says HouYi is based on GPT and requires an OpenAI API key in its configuration file. · github.com, 8 Oct 2026
Mitigation context: The paper says its investigation discusses possible tactics for mitigating prompt injection risks. · arxiv.org, 8 Oct 2026
Model requirement: The README says HouYi is based on GPT and requires an OpenAI key in its configuration to use it. · github.com, 8 Oct 2026
Purpose: HouYi is an automated prompt injection framework for LLM-integrated applications. · github.com, 8 Oct 2026
Research finding: The paper reports testing HouYi on 36 real LLM-integrated applications and finding 31 susceptible to prompt injection. · arxiv.org, 8 Oct 2026
Research package: The repository provides source code for the framework and a demo script that simulates an LLM-integrated application. · github.com, 8 Oct 2026
Setup: The README says to install the requirements and have Python 3.8 or later. · github.com, 8 Oct 2026
Support: The README lists contributor contact emails for Yi Liu and Gelei Deng. · github.com, 8 Oct 2026

Where HouYi stands on Freedom251

AI Red Teaming Tools#22 of 27