A free series that teaches LLM and AI application security the way you actually test it: short concept material, then a live in-browser lab where you run the loop — Attack → Defend → Verify. You exploit a real target, implement the fix, and prove the fix holds. No setup, no API keys, no Docker.
LLM vulnerabilities are the trust-boundary bugs you already hunt, on a new surface. The exploitation instinct transfers — but the defenses don’t, and that’s the part worth learning.
The one-sentence version: prompt injection is to LLM apps what SQLi was to web apps in 2002 — the canonical first bug — except the industry hasn’t found its parameterized queries yet, and may not. That’s why the defensive track here isn’t “use prepared statements”; it’s layered controls you verify under attack.
Ten years ago I published a free Android application security series at manifestsecurity.com. At the time, Android security had almost no free material to learn from — web security had plenty. That gap is why I wrote it. It still gets traffic today, and people still message me saying it’s how they learned Android pentesting.
Two paths are live now, and a new part ships every week — each mapped to the OWASP LLM Top 10 (2026), the Agentic AI Top 10, and the MCP Top 10, so you can cite a recognized framework in your reports.
New to the terminology? Browse the AI security glossary
Build the map before you specialise. The trust-model shift that makes LLM security different, just enough of how a model works, the attack surface where every OWASP LLM risk lives, and how it all maps to the AppSec you already know.
The attack every other LLM exploit rides on. Work the full technique tree — direct, jailbreaks, encoding, smuggling, context, indirect, and tool- and agent-mediated — then the controls that actually hold, each with a live target to try it on.
The next parts are dated below. Every part above is already available in full on the paid learning path — subscribe and work the whole series today.
Pull the hidden system prompt, secrets sitting in context, and training-data recitation out of the model.
Surface context the app never meant to return — RAG (retrieval-augmented generation) leakage and cross-tenant bleed from a shared retrieval pipeline.
Attack the vector store itself — embedding inversion, cross-tenant retrieval, and poisoned indexes.
Model output rendered or executed unsanitised — XSS, SQL injection, and stored second-order injection downstream.
Turn an agent's tools against it: over-scoped actions and the confused-deputy chain that makes a prompt trigger a privileged call.
Compromise what the app trusts before runtime — poisoned models, tampered dependencies, and unvetted third-party components.
Corrupt what the model learns or retrieves — poisoned training data, fine-tunes, and RAG sources that steer it.
The agent-specific risks: goal manipulation, unsafe tool use, memory poisoning, and multi-agent trust failures.
Model Context Protocol risks: malicious tool descriptions, over-permissioned connectors, and consent/onboarding injection.
If you find this series useful, share it — same as the Android series, it only grows by people passing it around.
Suggestions, problems, or a topic you want covered: [email protected]
© 2026 GenAI Security Lab. All rights reserved. You may read, quote, and link to this material with attribution. Copying, republishing, redistribution, resale, or use to train models or build competing products is prohibited without prior written permission.