AI & LLM Penetration Testing

What you'll learn

• Explain how LLMs process input well enough to predict where injection attacks succeed
• Craft direct and indirect prompt injection attacks against real LLM applications
• Bypass safety guardrails using established jailbreaking technique families
• Identify and exploit insecure output handling and excessive agency in LLM-integrated apps
• Attack RAG pipelines and vector databases via data poisoning and embedding manipulation
• Assess AI supply chain risk: model provenance, poisoning, and insecure plugin/tool integrations
• Test autonomous AI agents with tool access for real-world impact, not just chat-window tricks
• Map findings to the OWASP Top 10 for LLM Applications and write a report a non-ML team can act on

Who this course is for

Pentesters and AppSec engineers who already have solid general web/API testing skills and want to specialize in AI system security, the fastest-growing specialization in offensive security right now. Basic familiarity with how APIs and web apps work is assumed; no machine learning background required, everything ML-specific is taught from the ground up.