What you'll learn

Map the attack surface of an LLM app or agent and scope an authorized engagement

Run direct and indirect prompt injection and reproduce a data leak on a live local target

Bypass safety filters with persona, encoding, multi-turn, and crescendo techniques

Chain injection, memo poisoning, and tool abuse into an unauthorized money-movement kill chain

Run extraction and poisoning attacks and write a detector for the poisoned data

Layer defenses (guardrails, context separation, tool authorization) and re-run the attacks to measure the change

Automate red teaming with garak, PyRIT, and promptfoo, and gate a build in CI

Write a red-team report mapped to OWASP LLM 2026, MITRE ATLAS, and NIST AI RMF, and follow responsible disclosure

Requirements

A computer that can run a small local model (about 8 GB RAM recommended) and Python 3.11 or newer

Free software only: Ollama with a small local model; Docker is optional

Basic comfort with a terminal and reading short Python scripts

No prior AI security experience needed; general IT or security awareness helps

Description

This course contains the use of artificial intelligence.Most AI security courses show slides. In this course we attack a real LLM agent. We build a deliberately vulnerable banking assistant on our own computer, then break it, harden it, and break it again. The course combines 17 concept lectures, 9 live demos, and 8 hands-on labs. In the live demos we run each attack against a local target and watch the result on screen. In the labs we reproduce the attacks ourselves with downloadable starter files. Section quizzes, assignments, and a final practice exam help us check what we learned. The lab application runs entirely on your own machine with a free local model. You need no paid API keys, no cloud account, and no real data. Every technique is practiced only against this local training target. We cover prompt injection, hidden context exposure, jailbreaks and evasion, data extraction and poisoning, vector and embedding weaknesses, agent tool abuse, defenses, and automated red teaming with garak, PyRIT, and promptfoo. The content is mapped to the OWASP Top 10 for LLM Applications 2026 and MITRE ATLAS. All techniques are for authorized security testing and education only.Included: 17 concept lectures, 9 live demos against a local model, 8 hands-on labs with downloadable files, 8 section quizzes (47 questions), 8 assignments, and a 30-question final practice exam.

Security professionals, penetration testers, and red teamers moving into AI systems,Developers and engineers building LLM apps or agents who want to test them,AppSec, GRC, and AI governance practitioners who need hands-on understanding of AI risks,Students who learn best by watching attacks run and then repeating them