Security Challenges

9 CTF-style challenges worth 2,100 points that test your AI security exploitation skills against Cracky, the shop chatbot, and its knowledge base. The Agentic Kill Chain capstone also opens from the Challenges page in the app.

Challenges Are Available in the Full Application

Challenges require a running AI Goat instance with live LLM integration for dynamic flag generation and exploit-gated evaluation.

Deploy AI Goat

Challenge Architecture

Per-user flags

Each flag is an HMAC of the challenge and your user ID (format AIGOAT{32 hex}), so it cannot be shared or reused.

Exploit-gated

A server-side evaluator must see the exploit happen before the flag is released.

Server Validation

All submissions verified server-side by the evaluator.

Progressive difficulty

Four beginner challenges (100–150 pts) and five intermediate ones (200–500 pts).

Challenge Overview

Beginner

Prompt Injection LLM01

Make Cracky ignore its rules and reveal something it was told to protect.

100 pts

System Prompt Extraction LLM08

Get Cracky to disclose the hidden system prompt that governs its behavior.

100 pts

RAG Knowledge Poisoning LLM09

Poison the knowledge base so the chatbot answers with content you planted.

150 pts

Context Override LLM01

Get Cracky to replace the product and order context it was given with yours.

100 pts

Intermediate

Multi-turn Escalation LLM01

Escalate a normal product conversation over several turns until Cracky reveals protected data.

250 pts

Identity Hijacking LLM01

Convince Cracky to abandon its shop assistant identity and its restrictions.

200 pts

Authoritative Context Poisoning LLM02

Plant an official-sounding policy and get the chatbot to present it as fact.

300 pts

Chained KB + Injection LLM01 + LLM02

Chain knowledge base poisoning with a prompt injection so both succeed in one response.

400 pts

Guardrail Erosion LLM02

Socially engineer a security-conscious chatbot into leaking cross-user data after it has refused you.

500 pts