Direct Prompt Injection
A controlled comparison of a Vulnerable and a Hardened customer-support assistant configuration, testing whether an instruction not to disclose a value is an enforceable security boundary.
Updated 20 Sept 2026
Lab Catalog
25 labs across 8 categories, each carrying an explicit status —Planned, Building, Testing, Completed or Published. Nothing here is labeled Completed or Published unless the work behind it actually exists yet.
All labs
Unsafe LLM Output Handling
Testing what happens when an LLM's output is passed downstream — rendered as HTML, executed as code, or used to build a database query — without treating it as untrusted.
Updated 20 Sept 2026
Agent Tool Abuse
Testing whether an AI agent can be manipulated into calling a legitimate tool it has access to in an unintended or harmful way.
Updated 20 Sept 2026
Agent Privilege Escalation
Testing whether an AI agent operating under a scoped identity can be manipulated into performing actions beyond its granted privilege.
Updated 20 Sept 2026
Excessive Agency
Testing the gap between what an agent is capable of doing and what it actually needs to do to complete its intended task.
Updated 20 Sept 2026
Unsafe Delegation
Testing how authority and identity propagate when one agent delegates a sub-task to another agent or automated process.
Updated 20 Sept 2026
MCP Server Trust Failure
Testing what an agent implicitly trusts about an MCP server it connects to, and what happens when that trust is misplaced.
Updated 20 Sept 2026
Malicious MCP Tool
Testing what a single deliberately malicious tool exposed via MCP can do once an agent is willing to call it.
Updated 20 Sept 2026
Agent Memory Poisoning
Testing whether an agent's persistent memory can be manipulated in one session to change its behavior in a later, unrelated session.
Updated 20 Sept 2026
AI Credential / Secret Exposure
Testing the common places an AI application's API keys, model credentials and tool secrets end up exposed — logs, prompts, client code and error messages.
Updated 20 Sept 2026
LLM Gateway Policy Bypass
Testing whether the controls enforced by an LLM gateway — model allowlisting, prompt filtering, output validation — can be routed around.
Updated 20 Sept 2026
AI Supply Chain / Model Provenance
Testing how far a downloaded model's provenance can actually be verified, and what happens when it can't be.
Updated 20 Sept 2026
Malicious Model / Unsafe Serialization
Testing whether unsafe model-file formats and loading practices can lead to code execution, and how Safetensors and related safeguards change that.
Updated 20 Sept 2026
AI Logging & Detection Failure
Testing whether the attack techniques in the rest of this catalog actually show up in an application's logs and monitoring — or pass through silently.
Updated 20 Sept 2026
Guardrail Bypass
Testing how well common input/output guardrail products and patterns actually hold up against adversarial phrasing.
Updated 20 Sept 2026
Multi-Turn Manipulation
Testing whether a goal that fails as a single-message request succeeds when spread gradually across a longer conversation.
Updated 20 Sept 2026
Agent Human-Approval Boundary Failure
Testing whether a human-in-the-loop approval step for high-impact agent actions can be skipped, satisfied superficially, or otherwise defeated.
Updated 20 Sept 2026
Indirect Prompt Injection
A controlled comparison testing whether a document supplied for an entirely legitimate request — "summarize this" — can change what the AI application does.
Updated 20 Sept 2026
System Prompt & Context Leakage
A controlled comparison testing whether internal operating notes and a synthetic canary placed in a support assistant's system prompt can be recovered through ordinary conversation.
Updated 20 Sept 2026
Sensitive Information Disclosure
A controlled comparison testing whether a signed-in customer can obtain another customer's sensitive data from a support assistant — through records the application placed in the model's context, or through conversation history shared across sessions.
Updated 21 Sept 2026
RAG Data Exfiltration
A controlled comparison testing whether an authenticated user can retrieve, through a RAG pipeline, information from documents they are not authorized to read — because retrieval ranks chunks by semantic similarity but does not enforce access boundaries.
Updated 21 Sept 2026
RAG Poisoning
A controlled comparison testing whether a document placed into a RAG knowledge base without a verified source, approval record or integrity check can enter the production index and be retrieved for a legitimate query — because ingestion, not just retrieval, is a security boundary.
Updated 23 Sept 2026
Malicious Document Injection
A controlled comparison testing whether an instruction embedded inside a document can enter an LLM through a RAG retrieval pipeline and change the model's behavior for a legitimate user's query, even though the user never issued that instruction — and whether prompt-level labeling alone is enough to stop it, or whether the content has to be removed from context entirely.
Updated 23 Sept 2026
Vector Database Authorization Failure
A controlled comparison testing what happens when a multi-tenant vector-data API accepts caller-supplied tenant scope, document IDs and metadata filters without independently checking them against the caller's actual entitlements — measured directly at the API, with no LLM in the primary evidence.
Updated 23 Sept 2026
Cross-Tenant RAG Leakage
A controlled comparison testing whether information from one tenant can leak into another tenant's AI session through reused application state — a retrieval cache, an answer cache, or conversation memory — even though the underlying retrieval is correctly tenant-scoped on every single request.
Updated 23 Sept 2026
A decision is waiting for sign-off. Get an independent view first.
Tell me what is being decided and what is at stake. I will first say honestly whether my experience fits — then we talk about scope, not before.
Or connect on LinkedIn first.