Prompt injection examples you can run

A red-team engagement against an AI system means attacking it under authorization to find the flaws before someone hostile does. Large language model (LLM) applications add attack surface that a traditional pentest misses: the model reads retrieved documents and tool outputs as instructions, so an attacker who controls any of that text can steer the system. These labs work that surface against a real, deliberately-vulnerable Retrieval-Augmented Generation (RAG) assistant and tool-using agent, the same failure classes the safety and governance domains of NVIDIA NCP-AAI and Anthropic's CCAR-P ask you to reason about. They are cataloged against the OWASP Top 10 for LLM Applications and MITRE ATLAS by name.

The collection is ordered as an engagement. You open with reconnaissance: stand up the service, map its attack surface into a machine-checkable form, and build a deterministic success oracle that counts real effects instead of the model's confident talk. Then you make the assistant disclose what it should not, its hidden system prompt and confidential customer records. Next you steer the pipeline itself with indirect prompt injection and retrieval poisoning, and break tenant isolation to read another tenant's contract. From there the model's own output becomes the weapon: the EchoLeak markdown-image exfil channel, and tool arguments that reach server-side request forgery, SQL injection, and command execution. The agentic labs turn the agent against itself through tool-scope escalation (the confused-deputy problem) and memory poisoning that re-fires in a fresh session, then attack the supply chain with a poisoned MCP tool description, a shadowing tool twin, and a self-replicating Morris II payload across two agents. A final lab runs NVIDIA garak as an automated fuzzer and teaches the triage that separates a scanner operator from a red teamer.

Every lab runs in the browser against a live, sandboxed target Preporato provisions for your session, and none needs a GPU. Each is split into checkable steps and takes 70 to 100 minutes, and most close by shipping the fix and watching attack-success-rate fall.