genai
SECURITY LAB
Methodology

How we teach AI security that actually transfers

Reading about prompt injection doesn't make you good at finding it. Our scenarios put you in front of real, breakable systems and grade you on whether the exploit — and the fix — actually works.

01

Attack

Exploit a live target — override a support bot, poison a RAG index, hijack an agent loop — and capture proof.

02

Defend

Implement a real mitigation: sanitize input, anchor instructions, filter output, or add retrieval guardrails.

03

Verify

Confirm the fix actually holds under the original attack and its variants — not just that it looks right.

The Attack → Defend → Verify loop runs on every scenario.

Learning paths

Before you attack anything, you learn how it works

Every OWASP topic is a guided path — not a PDF. For each scenario you get:

  • A concept video (4–5 min) filmed for that exact mechanism
  • An annotated diagram showing exactly where the trust boundary breaks
  • The few principles that decide whether a control holds
  • The real-world incident it traces back to
  • Predict-before-reveal checkpoints — you commit a guess, then unlock the answer
  • A payload-and-pattern library you can actually reuse

Each topic runs two tracks: offensive (learn to exploit the flaw) and defensive (learn to hold the fix). Progress saves as you go, and every module maps back to the OWASP LLM Top 10 — so a finished path reads as coverage, not attendance.

genaisecuritylab.com/learn/prompt-injection
Learning module
Concept video · 4:12
Annotated diagram
See exactly where the trust boundary breaks.
Key principles
The rules that decide whether a control holds.
Predict the outcome
Commit a guess before the answer unlocks.
Interactive
Break the fix
Pick the control that actually holds.
Interactive
Hands-on lab
Exploit it on a live target, then defend it.
Interactive
Interactive by design

Nobody reads a wall of text, so we didn't write one

Be honest: a page of security prose gets skimmed once and closed. And passive reading doesn't transfer anyway — the moment you're in front of a live target and have to find the surface yourself, none of it is in your hands. So the concept isn't something you read. It's a few minutes of video and a run of short checkpoints, and every one of them makes you do something.

You commit a prediction before the answer unlocks. You recall the technique from memory instead of re-reading it. You choose which fix actually holds among controls that all look reasonable, and you finish a half-built exploit by supplying the one line that matters. Topics are interleaved so you can't coast on context, and a short warm-up brings the last session back when you return.

Predict before the reveal

Commit a guess first — a wrong answer you owned sticks far better than one you were simply shown.

Recall, don't re-read

Pull the technique back from memory. The attempt is the point; nothing here is scored.

Break the fix

Pick the control that holds among naive fixes an attacker would edit straight around.

Complete the exploit

A payload is built except for the one decisive fragment. You supply it, then see why it matters.

Interleaved, not grouped

Attack families are shuffled together, so you learn to tell them apart instead of memorizing an order.

Spaced return

Come back later and a short warm-up recovers the last session before you go deeper.

Live targets

You attack it the way a real user would

Scenarios run against real applications — a real storefront, an internal knowledge base, a developer forum — not toy prompts.

You're a customer, an employee, a forum member. The vulnerability lives where it would in production: in the seam between untrusted input and privileged instructions. You have to find the surface yourself.

shopbot.store
Target
LIVE TARGET · LLM01
ShopBot Store
A real storefront with a support assistant behind a system prompt. Your job: make it say what it shouldn't.
ShopBot Assistant
Auto-grading

You're graded on outcomes, not essays

When you think you've succeeded, you submit evidence. The grader doesn't read prose — it re-runs the exploit.

  • For attacks: it confirms the payload actually produced the restricted output
  • For defenses: it confirms your change actually holds against the attack and its known variants
  • If your fix doesn't hold: it tells you exactly which variant leaked, and why

That means instant, trustworthy feedback — and a completion record your team lead can actually rely on.

genaisecuritylab.com/verify
Grader
Original injection payloadBlocked
Role-play bypass variantBlocked
Encoded payload variantLeaked — add output filtering
Coverage

Every scenario maps to the OWASP LLM Top 10

Skills are organized around the OWASP LLM Top 10 (2026), the field's shared language for AI risk. Each scenario is tagged to one or more categories, so your progress reads as coverage — not points — and gaps are obvious.

LLM01Prompt Injection
LLM02Sensitive Information Disclosure
LLM03Excessive Agency
LLM04Supply Chain
LLM05Data & Model Poisoning
LLM06Unbounded Consumption
LLM07Misinformation
LLM08Hidden Context Exposure
LLM09Vector & Embedding Weaknesses
LLM10Improper Output Handling
Standards

Mapped to the frameworks your program already reports against

Coverage doesn't stop at OWASP. Every scenario is cross-referenced to the control frameworks your security program and auditors already use, so training coverage doubles as evidence. We describe this as alignment and mapping — not certification.

OWASP LLM Top 10

Each scenario tagged to one or more categories; coverage is reportable per person and per team.

NIST AI RMF

Scenarios map to the Govern, Map, Measure, and Manage functions of the AI Risk Management Framework.

MITRE ATLAS

Offensive techniques reference real ATLAS adversary tactics against ML/AI systems.

ISO/IEC 42001

Training maps to AI management-system control areas for your ISMS evidence.

Try a scenario yourself

Start with a direct prompt injection against ShopBot — it takes about 35 minutes.