Prompt injection and LLM attack labs
Fourteen authorized red-team labs: exploit a sandboxed RAG assistant and tool agent, measure attack-success-rate, then watch the fix hold.
A red-team engagement against an AI system means attacking it under authorization to find the flaws before someone hostile does. Large language model (LLM) applications add attack surface that a traditional pentest misses: the model reads retrieved documents and tool outputs as instructions, so an attacker who controls any of that text can steer the system. These labs work that surface against a real, deliberately-vulnerable Retrieval-Augmented Generation (RAG) assistant and tool-using agent, the same failure classes the safety and governance domains of NVIDIA NCP-AAI and Anthropic's CCAR-P ask you to reason about. They are cataloged against the OWASP Top 10 for LLM Applications and MITRE ATLAS by name.
- A structured attack-surface map of a real RAG assistant and a deterministic success oracle that counts real effects, not the model's talk
- An indirect prompt injection that exfiltrates a customer record through the EchoLeak markdown-image channel, with its attack-success-rate measured
- A poisoned document that wins cosine top-k across a whole query class, plus a cross-tenant read that breaks RAG metadata isolation
- Agent takeovers by tool-scope escalation and memory poisoning, a poisoned MCP tool description, a shadowing tool twin, and a Morris II payload across two agents
- A NVIDIA garak fuzzing run triaged into true and false positives against a live vulnerable target
All 14 labs are hosted against sandboxed vulnerable targets and run in the browser; none needs a GPU pod.
- Python basics and comfort reading a short script
- What retrieval-augmented generation and a tool-calling agent are; the labs define the specifics in context
- These are authorized exercises: you attack only Preporato's own sandboxed targets, never a live third-party or production system
How the path is sequenced
The collection is ordered as an engagement. You open with reconnaissance: stand up the service, map its attack surface into a machine-checkable form, and build a deterministic success oracle that counts real effects instead of the model's confident talk. Then you make the assistant disclose what it should not, its hidden system prompt and confidential customer records. Next you steer the pipeline itself with indirect prompt injection and retrieval poisoning, and break tenant isolation to read another tenant's contract. From there the model's own output becomes the weapon: the EchoLeak markdown-image exfil channel, and tool arguments that reach server-side request forgery, SQL injection, and command execution. The agentic labs turn the agent against itself through tool-scope escalation (the confused-deputy problem) and memory poisoning that re-fires in a fresh session, then attack the supply chain with a poisoned MCP tool description, a shadowing tool twin, and a self-replicating Morris II payload across two agents. A final lab runs NVIDIA garak as an automated fuzzer and teaches the triage that separates a scanner operator from a red teamer.
Every lab runs in the browser against a live, sandboxed target Preporato provisions for your session, and none needs a GPU. Each is split into checkable steps and takes 70 to 100 minutes, and most close by shipping the fix and watching attack-success-rate fall.
Recon and disclosure
Map the attack surface and build a success oracle, then make the assistant reveal its hidden prompt and confidential records.
Injection and retrieval poisoning
Steer the pipeline: exfiltrate through indirect injection, win top-k with a poisoned document, and break tenant isolation.
Insecure output and tool abuse
Turn the model's output into the attack: EchoLeak exfil, SSRF/SQLi/RCE through tool arguments, scope escalation, and persistent memory poisoning.
Supply chain, worms, and automation
Poison an MCP tool registry, shadow a trusted tool, propagate a Morris II worm across agents, then fuzz with garak and triage the hits.
Run all 14 labs in this path, and every other lab and practice test on Preporato.
- All 14 labs in this path
- Dedicated GPU pods included
- Every certification practice test
- Cancel any time
Frequently asked questions
Yes. Every target is a deliberately-vulnerable application Preporato provisions for your session in an isolated sandbox, and it is torn down when you finish. You never touch a third-party or production system. This is authorized red-team practice, the same footing as a capture-the-flag exercise.
Safety guardrails, responsible-AI practice and human oversight are graded domains on NVIDIA NCP-AAI, and the Governance, Safety & Risk Management domain of Anthropic's CCAR-P covers guardrails and LLM failure modes. Proving what breaks those controls is the fastest way to understand them. The labs are cataloged against the OWASP Top 10 for LLM Applications and MITRE ATLAS by name.
No. Start with the recon lab, which builds the methodology and the attack-success-rate harness the rest reuse. Every exploit is confirmed by an automatic check against the live target, so you know when it actually landed rather than when the model merely claims it did.
The labs are included in Preporato Pro ($29.99 per month or $290 per year), which also covers every practice test and every other lab on the platform. Individual lab pages show the full brief before you subscribe.