AI Goat attack labs

46 hands-on labs across four attack surfaces: LLM chat, RAG, MCP and tool-calling AI agents. Every lab maps to a risk in the OWASP LLM, Agentic or MCP Top 10. Each one has a goal, example payloads and the result to expect at every defense level, so you can exploit it at L0 and then see what L1 and L2 stop.

LLM labs: 23
MCP labs: 11
Agentic labs: 12

The labs run in your own AI Goat instance

Labs run against a live local model, real MCP servers and a tool-calling agent, so you need AI Goat running on your machine, in Docker or in Google Colab. Agent, MCP host and kill chain labs need a tool-calling model such as qwen3.5:9b.

$ git clone https://github.com/AISecurityConsortium/AIGoat.git
$ cd AIGoat && ./scripts/start.sh

Clone the repository Docker and Colab options

OWASP Top 10 for LLM Applications labs (2026)

LLM01 Prompt Injection

5 labs

llm01-1 Prompt Injection Basics Beginner
llm01-2 Indirect Injection Beginner
llm01-3 Chained Injection Intermediate
llm01-4 Indirect Injection via Retrieved Document Intermediate
llm01-5 Cross-Document Instruction Assembly Advanced

What is LLM01?

LLM02 Sensitive Information Disclosure

4 labs

llm02-1 Data Leakage Beginner
llm02-2 Training Data Extraction Intermediate
llm02-3 Context Poisoning Intermediate
llm02-4 Unauthorized Retrieval Intermediate

What is LLM02?

LLM03 Excessive Agency

3 labs

llm03-1 Excessive Agency via Tools Intermediate
llm03-2 Tool Allowlist Bypass Intermediate
llm03-3 Overpowered Assistant Intermediate

What is LLM03?

LLM04 Supply Chain

1 lab

llm04-1 Modelfile Backdoor Intermediate

What is LLM04?

LLM05 Data and Model Poisoning

1 lab

llm05-1 Data and Model Poisoning Beginner

What is LLM05?

LLM06 Unbounded Consumption

1 lab

llm06-1 Token Flood Intermediate

What is LLM06?

LLM07 Misinformation

1 lab

llm07-1 Misinformation Intermediate

What is LLM07?

LLM08 Hidden Context Exposure

1 lab

llm08-1 System Prompt Extraction Beginner

What is LLM08?

LLM09 Vector and Embedding Weaknesses

5 labs

llm09-1 Vector and Embedding Weaknesses Beginner
llm09-2 Retrieval Keyword Stuffing Intermediate
llm09-3 Trust-Tier Spoofing Beginner
llm09-4 Context Flooding Intermediate
llm09-5 Stale Knowledge Beginner

What is LLM09?

LLM10 Improper Output Handling

1 lab

llm10-1 Improper Output Handling Beginner

What is LLM10?

OWASP Top 10 for Agentic Applications labs (2026)

ASI01 Agent Goal Hijack

1 lab

asi01-1 Planted Ticket Rewrites the Goal Intermediate

What is ASI01?

ASI02 Tool Misuse and Exploitation

1 lab

asi02-1 Tool Misuse Intermediate

What is ASI02?

ASI03 Identity and Privilege Abuse

1 lab

asi03-1 Export Another Customer Intermediate

What is ASI03?

ASI04 Agentic Supply Chain Vulnerabilities

1 lab

asi04-1 Hostile Catalogue Intermediate

What is ASI04?

ASI05 Unexpected Code Execution (RCE)

1 lab

asi05-1 Sandboxed Shell Executor Beginner

What is ASI05?

ASI06 Memory & Context Poisoning

3 labs

asi06-1 Memory Poisoning Intermediate
asi06-2 Memory Scan at Level 2 Beginner
killchain-1 Agentic Kill Chain: The Compromised eCommerce Agent Advanced

What is ASI06?

ASI07 Insecure Inter-Agent Communication

1 lab

asi07-1 Unsigned Handoff Intermediate

What is ASI07?

ASI08 Cascading Failures

1 lab

asi08-1 Fan-out and Circuit Breaker Advanced

What is ASI08?

ASI09 Human-Agent Trust Exploitation

1 lab

asi09-1 Human-Agent Trust Exploitation Beginner

What is ASI09?

ASI10 Rogue Agents

1 lab

asi10-1 Rogue Note on the Next Run Advanced

What is ASI10?

OWASP MCP Top 10 labs (2025, beta)

MCP01 Token Mismanagement & Secret Exposure

1 lab

mcp01-1 Token Mismanagement & Secret Exposure Beginner

What is MCP01?

MCP02 Privilege Escalation via Scope Creep

1 lab

mcp02-1 Scope Creep / Capability Discovery vs Authorization Beginner

What is MCP02?

MCP03 Tool Poisoning

3 labs

mcp03-1 Tool Description Poisoning Beginner
mcp03-2 Tool Redefinition (Rug-Pull) Intermediate
mcp03-3 Tool Schema Drift Intermediate

What is MCP03?

MCP04 Software Supply Chain Attacks & Dependency Tampering

1 lab

mcp04-1 Lookalike Integration Intermediate

What is MCP04?

MCP05 Command Injection & Execution

no lab

Documented only, by design. Practise code execution in ASI05.

What is MCP05?

MCP06 Intent Flow Subversion

1 lab

mcp06-1 Poisoned Ticket Flips the Next Call Intermediate

What is MCP06?

MCP07 Insufficient Authentication & Authorization

1 lab

mcp07-1 Token Passthrough Intermediate

What is MCP07?

MCP08 Lack of Audit and Telemetry

1 lab

mcp08-1 Reconstruct the Session Beginner

What is MCP08?

MCP09 Shadow MCP Servers

1 lab

mcp09-1 Unverified Server Identity Intermediate

What is MCP09?

MCP10 Context Injection & Over-Sharing

1 lab

mcp10-1 Tickets Dumped into Context Intermediate

What is MCP10?