AI Red Teaming & LLM Penetration Testing

This course contains the use of artificial intelligence.

Large language models shipped into production faster than the tools to test them. This hands-on, offensive-security course teaches you to actively break LLMs and the apps and agents built on them — and then to make them resilient.

You'll work as the red team for Stride, a fintech whose in-app assistant "Sol" can move money and read customer data. After a researcher tricked Sol into leaking a customer's account via a transaction-memo field, Stride stood up a red-team program — that's you. Every technique you learn, you perform on a local, deliberately-vulnerable copy of Sol on your own machine. Nothing here is run against systems you don't own.

Across 36 motion-first lectures and 8 runnable labs you'll learn to:

• Map the attack surface of any LLM application or agent

• Land direct and indirect prompt injection and reproduce a real data-leak

• Jailbreak and bypass safety filters with persona framing, encoding, multi-turn/crescendo, many-shot, automated adversarial suffixes, and cross-lingual tricks

• Run adversarial-input, training-data extraction, poisoning, backdoor, and model-theft attacks

• Exploit RAG poisoning, tool and function-calling abuse, excessive agency, and insecure output handling (XSS/SSRF/RCE from model output)

• Build layered defenses: guardrails, canary tokens, system-prompt hardening, privilege separation, RAG/tool sandboxing, and detection

• Automate red teaming with Garak, PyRIT, and promptfoo — including continuous red teaming in CI/CD

• Write a governance-grade report mapped to OWASP LLM Top 10, MITRE ATLAS, and NIST AI RMF, and run responsible disclosure

Every attack section is paired with the defense that neutralizes it. The course ends with a capstone engagement: scope, recon, exploit, measure impact, harden Sol, re-run your attacks to prove the fix, and deliver a publishable red-team report.

This is an advanced course. You should be fluent in Python, comfortable with the command line and Docker, and already think like a security person. You do not need deep machine-learning math — Lecture 2 covers exactly the model internals you need to attack.

Frameworks anchored throughout: OWASP Top 10 for LLM Applications (2025), MITRE ATLAS, NIST AI RMF, the EU AI Act, and ISO/IEC 42001.

By the end you won't just understand AI risk in the abstract — you'll be able to test an AI system, prove what's broken, and show the team how to fix it.