See inside AI systems.
Watch them break.
Learn to defend them.
Modern GenAI and agentic systems are more than a model. Explore them layer by layer, trigger failure scenarios, dissect how real-world incidents unfolded, and discover where risks arise — and which controls actually contain them.
Learning paths
Guided tracks for every audience, from the merely curious to the deeply technical. The depth dial reshapes every explanation as you go.
Start Here: How AI Systems Actually Work
Build an intuition for what's inside a modern AI assistant, one layer at a time, and see your first thing-goes-wrong story.
- 🗺️Meet the simplest assistant: you, a prompt, a model.
- 🗺️Give it a library to look things up in.
- ⚠️Watch a confident chatbot invent a policy — and who pays.
- 🗺️Now let it take actions in the real world.
- ⚠️See how a hidden message in a document hijacks an agent.
- 🧪Build your own system in the Sandbox — watch risks light up as you wire it.
- 📖Skim the glossary to lock in the vocabulary.
AI Risk Practitioner Track
Work through the OWASP-aligned threat landscape with hands-on incidents, mapping each to root causes, controls, and frameworks (OWASP, ATLAS, NIST AI RMF).
- 🗺️Anchor on the tool-using agent — the workhorse architecture.
- ⚠️The 'lethal trifecta' in action: injection + tools + data.
- ⚠️Zero-click data exfiltration via auto-rendered output.
- ⚠️Over-privileged agent, one destructive command.
- ⚠️A one-time trick that persists across every session.
- ⚠️Corrupt the knowledge base, corrupt every answer.
- 📰Read a disclosed real-world version: ForcedLeak in Salesforce Agentforce.
- 🧭Walk the framework hubs — every OWASP / ATLAS ID with its real incidents.
- 🛡️Finish in the Control Library: preventive / detective / corrective coverage.
Agentic & Multi-Agent Security
Go deep on the hardest surface in modern AI: autonomous agents, tools, MCP integrations, and teams of agents coordinating.
- 🗺️Re-examine the agent loop as a privilege boundary.
- ⚠️A malicious MCP tool that hides commands in its description.
- ⚠️Generated code that injects into your database.
- 🗺️Scale up to a team of coordinating agents.
- ⚠️One poisoned worker hijacks the whole team.
- ⚠️How small errors snowball across agents.
- 📰Study a real autonomous-agent intrusion end to end.
- 🧪Rebuild your own agent stack in the Sandbox and close every open risk.
Below the App Layer: Model & Inference Attacks
The deepest tier: transformer internals, weight tampering, and inference-time manipulation — the attacks that bypass every application control.
- 🗺️Open the model and trace a token through inference.
- ⚠️Strip a model's refusals with a one-direction weight edit.
- ⚠️A sleeper agent that activates only on a secret trigger.
- ⚠️Leak another user's prompt through cache timing.
- 📊Cross-reference the infra/model risks in the Risk Taxonomy.
How the lab works
Open an architecture and follow a request through every component — interface, model, retrieval, tools, oversight.
Run a scenario step by step. Watch data and instructions flow, see where the attack enters, and where the harm lands.
At the decision point, choose a defense and see how the outcome changes — including the controls that look right but don't work.
Walk through how an actual incident unfolded on its architecture, the controls that would have prevented it, and the gaps it surfaces.