Prompt Injection & Jailbreaking: Offensive LLM Red-Teaming

This course contains the use of Artificial Intelligence.

Large language models cannot reliably tell an instruction apart from data. That single architectural fact is the root cause of prompt injection, jailbreaking, and every attack in this course. Over 10 sections and 63 lectures you learn to exploit it like a professional red-teamer, working entirely against your own self-hosted, sandboxed target.

Every technique is applied to one consistent target: Nimbus Copilot, the LLM support assistant of a fictional B2B SaaS company, NimbusAI. Copilot answers questions over a RAG knowledge base, calls real tools (refunds, email, ticket escalation, order lookups), and reads uploaded screenshots — four injection surfaces with real impact. You play the external red team hired to break it before release, running against an authorized clone called copilot-sandbox.

This is a hands-on course. You will craft and chain direct jailbreaks against a live refusal layer; defeat filters with encoding evasion (Base64, ROT13, homoglyphs, token smuggling, Unicode tricks); plant indirect payloads in RAG documents, poisoned web pages, emails, and invisible text; turn injection into impact by hijacking tool calls (confused-deputy attacks), exfiltrating secrets through image beacons and outbound email, and achieving persistence via memory; attack multimodal channels with image, OCR, and adversarial-image payloads; scale up with automated red-teaming (crescendo, many-shot, GCG adversarial suffixes, transfer attacks, PAIR/TAP loops); and recon a target, extract hidden system prompts, and read the OWASP LLM Top 10 as an attacker.

You practice with 9 guided labs — one per section — and a graded CTF capstone where you run a full engagement, capture six escalating flags, and deliver a findings report. A dedicated defenses section shows exactly where each control breaks, so you can advise clients as well as attack them.

Responsible use: these techniques are taught for authorized red-teaming, security research, and CTF contexts only. Every lab runs against the course's own sandboxed application — never a live third-party product — and every attack is paired with its detection and defense.