AI Security and LLM Red Teaming is a hands-on course in testing and defending LLM applications and AI agents using the OWASP Top 10 for LLM Applications 2026, from prompt injection, data leakage and RAG weaknesses to automated red teaming with promptfoo and layered guardrails. It suits security engineers, penetration testers and developers who build AI applications.
LLM applications, from chatbots and RAG systems to AI agents that call tools on their own, are moving into real business systems. Their weaknesses are unlike those of ordinary web applications. Plain text in an email or a document can instruct the model to do something it should not, secrets in the context can leak into an answer, and an agent with too many permissions can be tricked into deleting data or sending it outside the organisation. Traditional scanners miss most of these risks.
This course takes learners through hands-on security testing of LLM applications from a defender's point of view, using the OWASP Top 10 for LLM Applications 2026 and the OWASP Top 10 for Agentic Applications as the framework. Every lab targets only deliberately vulnerable demo applications that run on the learner's own machine. Learners start with direct and indirect prompt injection, data leakage and RAG weaknesses, then move on to attacking AI agents through tools and MCP. They then use promptfoo for automated red teaming, build layered guardrails, run the tests in CI/CD, and finish with a capstone in which they write a findings report with recommended fixes for the development team. (2 days, 6 hours per day, 12 hours in total, Intermediate level.)
Course Details
A 2-day course, 6 hours per day (12 hours in total, 09:00-16:00), alternating lectures with labs. Intermediate level. Every lab targets only deliberately vulnerable chatbot, RAG and AI agent applications that run on the learner's own machine with Docker. The content follows the OWASP Top 10 for LLM Applications 2026 and the OWASP Top 10 for Agentic Applications, from a defender's point of view:
every attack ends with how to fix it. The course builds on Ethical Hacking and Penetration Testing Fundamentals and focuses entirely on LLM-based applications. Learners use small local models through Ollama, or their own or company LLM API key, with API usage billed by actual use. Learners take home a lab guide, docker-compose files for the demo applications, promptfoo configurations and a red team report template.
Section 1: Lab: AI Red Teaming and Setting Up the Test Range
Section 2: OWASP Top 10 for LLM Applications 2026
Section 3: Lab: Direct and Indirect Prompt Injection
Section 4: Lab: Data Leakage and Hidden Context Exposure
Section 5: Lab: Output Handling and Unbounded Consumption
Section 6: Lab: RAG Weaknesses and the Supply Chain
Section 7: Excessive Agency and the Agentic Top 10
Section 8: Lab: Testing AI Agents, Tools and MCP
Section 9: Lab: Automated Red Teaming with promptfoo
Section 10: Lab: Guardrails and Defence in Depth
Section 11: Continuous Testing and Production Monitoring
Section 12: Workshop: Capstone Red Team Engagement
No public rounds are open right now. Join the waiting list and we will contact you first when the next round opens, or ask us on LINE. Or call 02-570-8449 or 088-807-9770
Prompt injection is inserting text that makes a model follow an attacker's instructions instead of the ones the system set. In a direct attack, the attacker types the instruction or jailbreak into the chat themselves. In an indirect attack, the instruction is hidden in a web page, email, PDF or document that the model reads, which is more dangerous because the user may never notice. That is why untrusted external content must always be kept separate from system instructions.
Current thinking accepts that the model can be fooled and designs the surrounding system to keep the damage small. Check input and separate external content from instructions, then check output before displaying or passing it on, for example encoding it before rendering as HTML. Give tools only the permissions they need (least privilege), require human confirmation before irreversible actions, and keep an audit log of what the agent did.
Start by configuring promptfoo to send requests to the target application through an HTTP or Python provider. Choose plugins and strategies that match the application's risks on the OWASP list, run the scan and read the report, filtering out false positives before ranking the weaknesses to fix. After fixing, scan again to compare results, and add the test suite to CI/CD so problems are caught whenever the prompt or model changes.
It suits security engineers and penetration testers who need to test systems built on LLMs or AI agents, developers building chatbots, RAG or agents, and AppSec or DevSecOps teams setting testing standards for AI applications. You should be able to write basic Python and read code that calls an LLM API, understand web security basics such as XSS and SQL injection, and have a basic grasp of RAG and AI agents.
You will be able to test for direct and indirect prompt injection and data leakage, assess RAG and AI agent weaknesses against the OWASP lists, build automated red team suites with promptfoo, design layered guardrails, and write findings reports with risk ratings and fixes the development team can act on. Participants who complete the training receive a Certificate of Completion with its own number, which can be verified online.
Bring a laptop with at least 16 GB of RAM that can run Docker Desktop, Node.js and Python, because the deliberately vulnerable sample applications run on your own machine in Docker. For the model, you can use a small model through Ollama locally or your own or your company's LLM API key, with API usage charged by the provider according to actual use.
Most SOC teams are not short of data. They are buried in alerts that must be opened one at a time, switching screens to look up IPs or hashes, rewriting queries for every hunt and spending hours turning incidents into reports. AI and LLMs can take a lot of…
An organization can only defend well when it understands how attackers think and operate. This course teaches ethical penetration testing following a standard methodology: defining scope and obtaining written authorization, reconnaissance, scanning and…
Development teams now ship code to production several times a day with CI/CD, yet much of the security work still waits for a final check just before release. Vulnerabilities are found late, when they are hard and expensive to fix, or they slip into…
