Run a Full LLM and Agent VAPT Engagement, Then Ship the Remediations

ACME Cloud has shipped an AI-powered support and operations platform and hired your firm for a full red-team engagement before it goes GA. The starter kit ships the whole stack so you can run the engagement offline: DV-RAG-Support, a multi-tenant Retrieval-Augmented Generation assistant that answers staff and customer questions; DV-ToolAgent-Mini, a ReAct agent whose output drives an HTTP fetch tool and a shell-backed provisioning helper; DV-ToolAgent, an operations agent with a write-capable SQL tool and durable memory; a two-agent intake-to-fulfillment graph; and a DV-MCP tool registry whose tool descriptions the agent trusts at connect time. The rules of engagement are the usual ones. You do not jailbreak the model or touch its weights, you do not social-engineer staff, and you stay inside the sandbox. Your foothold is the foothold a real attacker gets: a document the RAG indexes, a ticket the agent ingests, a tool result the agent trusts, a durable memory note, a tool description the registry serves, or an inbound email one agent summarizes for another.

Your lead wants a real engagement, not a list of one-off chatbot quirks. She wants reconnaissance that maps the attack surface, at least five DISTINCT OWASP LLM and Agentic classes proven with reproducible PoCs, a defensible severity rating per finding, remediations you re-tested as code against your own exploits without breaking the benign baseline, and a written report a platform team can act on. You run the whole engagement against the provided stack with engagement.py, confirm each PoC fires and each fix holds with the deterministic selfcheck.py, then zip the project and submit it here for the engagement grade.

This is the capstone of the AI Red Team path: a build-and-submit engagement, not a quiz about LLM security. You run a full vulnerability assessment and penetration test against ACME Cloud's deliberately-vulnerable agent stack (a multi-tenant RAG assistant, a tool-using ReAct agent, a two-agent graph, and an MCP tool server), exploit at least five distinct OWASP LLM and Agentic classes with reproducible PoCs delivered indirectly through retrieved, tool, or inter-agent data, rate each finding's severity, ship remediations you re-test against your own exploits, and deliver a professional engagement report.

The classes you cover map across the OWASP Top 10 for LLM Applications (LLM01 Prompt Injection, LLM02 Sensitive Information Disclosure, LLM05 Improper Output Handling, LLM06 Excessive Agency, LLM08 Vector and Embedding Weaknesses), the OWASP Top 10 for Agentic Applications (ASI02 through ASI08), and MITRE ATLAS (indirect prompt injection, RAG poisoning, data leakage, and the agent supply-chain techniques), anchored by real incidents like EchoLeak and the Morris II GenAI worm. The skill this capstone proves is the one a hiring manager looks for: not one clever jailbreak, but a full engagement of distinct, proven, rated, and remediated findings tied together by a report a platform team can act on.

Grading is rubric-based and explainable. Your submission is scored against weighted criteria (runnable PoCs across classes, indirect delivery, concrete impact and coverage, severity and mapping, proven remediations, and report quality) with per-criterion feedback. You run and confirm the whole engagement offline with the starter kit's deterministic selfcheck before you submit; this task grades the engagement project you build. The pass threshold is 65 percent and you can resubmit. Questions about the task go to andrew@predica.ai.