The Ultimate AI/LLM/ML Penetration Testing Training Course

Explore the loop library to test agentic loops with iterative feedback and conditional prompting, including a refund loop example that demonstrates prompt injection and red-teaming opportunities.

Explore how indirect prompt injection defeats Apple email summary and calendar invites, revealing vulnerabilities in AI summarizers and the need for stronger guardrails to prevent sensitive data leaks.

Explore indirect prompt injection via skills files in frontier models, and learn to review downloaded skills, test for ascii unicode prompts, and guard against data exfiltration in penetration testing.

Explore how indirect prompt injection into Grok tasks can trigger unwanted cron jobs by uploading a document that schedules automated tasks without user confirmation, causing recurring notifications.

Examine indirect prompt injection via a document or email, where an agent summarizes text and sends it to a specified address, highlighting automation risks and accountability.

Discover how indirect prompt injection occurs when the Google Calendar connector reads a calendar event description, exposing AI agents to unsolicited invites and injected prompts.

Demonstrate indirect prompt injection using Grok to auto-create a GitHub repository from a document via Krok connectors, highlighting write access and automated actions on GitHub.

Explore how indirect prompt injection triggers agentic actions to auto-schedule fake meetings via calendar invites and emails, revealing risks through temp-mail.org and calendar connectors.

Explore indirect prompt injection and memory exfiltration by generating an image from memory data and uploading it to a Google Drive folder, highlighting a dangerous automation pipeline.

Discover how prompt injection via prompting can alter frontier LLM settings, revealing writable options such as memory, tone, style, and conversation scope, with examples across Copilot, JetGPT, Claude, and Gemini.

Explore indirect prompt injection and prompt begging in AI agents, via the Hugging Face incident. Analyze security.txt and robots.txt analogies and GitHub lure tactics in agentic AI attacks.

Explore indirect prompt injection in a vulnerable recruitment app, demonstrating how a prompt embedded in resumes or emails can exfiltrate base64 encoded data and pii during pre-screening.

Demonstrates a zero-click data exfiltration vulnerability in a chat bot integration, using a markdown image render payload to exfiltrate conversation data from chat interfaces like Rakuten Fiber with GPT 5.5.

Demonstrates indirect prompt injection that chains actions to exfiltrate PII from G drive via email, highlighting data leakage risks in security testing.

Explore how indirect prompt injection in documents can generate phishing links and drive-by malware, exposing risks in large language models like Gemini and other AI systems.

Demonstrates how prompt injection can delete user memories in ChatGPT through a live memory-clear demo. Discusses indirect prompt injection risks to the memory tool and urges stronger safeguards.

Examine how ANSI escape codes in terminal emulators enable prompt injection in LLMs, revealing risks such as beeps, cursor moves, hidden text, clipboard exfiltration, and potential remote code execution.

Demonstrate indirect prompt injection using ANSI escape codes to exfiltrate data via DNS, noting Linux terminal vulnerabilities and macOS fixes.

Prevent sensitive information disclosure by enforcing strict access control and least privilege. Guard PII, financial and HR data with context aware filtering and redaction in RAG storage to avoid leaks.

Explore how sensitive information disclosure occurs in AI systems, including PII and training data, and how encryption, key management, and strict access controls prevent leaks.

Explore direct prompt injection in llms with a deliberately vulnerable lm agent, demonstrating information disclosure that exposes other users' transactions and pii.

Demonstrates a data exfiltration attack in a learning management system using a prompt-injection payload in markdown to leak information when a user clicks a link, revealing markdown rendering vulnerabilities.

Enumerating Grok's container dives into a Linux VM inside a container to inspect processes, memory, and binaries, and demonstrates how outbound network activity and GitHub connectors can enable data exfiltration.

Examine excessive agency in LMS, where AI agents call APIs, invoke tools, or browse the web, risking data disclosure and unintended actions; apply guardrails, least privilege, and human oversight.

Excessive agency in AI systems grants LLMs too much autonomy to call back-end APIs without human oversight. This enables unintended actions like refunds or data changes via prompts and plugins.

Examine insecure plugin design and how missing access control threatens LLMs through untrusted plugins. Learn defenses like code reviews, isolation, and granular authorization to prevent data exfiltration and prompt injections.

Demonstrates exploiting LLM APIs with excessive agency by prompting an AI to access back end APIs and delete a user, revealing how prompt injection bypasses front-end controls.

Explore OS command injection vulnerabilities in LMS APIs, showing how an LLM with backend access can exploit APIs like password reset, newsletter, and product information to perform unauthorized actions.

this lecture explains supply chain vulnerabilities in lms, including third-party components, pre-trained models, plugins, and open-source code, with vetting, provenance, zero-trust, and backdoor awareness.