AI Pentesting

Interactive environments let you hack simulated AI systems directly in your web browser.

• PortSwigger Web Security Academy: Complete their dedicated, free PortSwigger LLM Attacks Labs to practice basic prompt injection and exploit web applications using AI.
• Hack The Box (HTB) Sherlocks: Create a free account and look for entry-level machine learning and LLM challenge rooms on Hack The Box.
• Vanna AI & Gandalf: Play the gamified Gandalf AI Prompt Injection Game to learn how to trick AI into revealing hidden passwords.

2. Take Beginner-Friendly Free Courses

Use these structured video paths designed specifically for absolute beginners.

• FreeCodeCamp: Watch their comprehensive, free tutorials on freeCodeCamp YouTube covering "Python for Beginners" and "Introduction to Machine Learning".
• DeepLearning.AI: Take the short, free DeepLearning.AI Prompt Engineering Course to understand how developers build AI apps, which makes them easier to break.

3. Learn the 3 Most Common Beginner Exploits

Focus your initial study strictly on these three vulnerability types:

• Direct Prompt Injection: Writing text instructions that force an AI to ignore its developer rules and perform malicious actions.
• Indirect Prompt Injection: Hiding malicious instructions inside a webpage or document that the AI reads, tricking it without the user's knowledge.
• Data Leakage: Tricking an AI into revealing sensitive system prompts, source code, or private user data from its training set.

4. Set Up a Free Local Practice Lab

You can run an open-source AI locally on your laptop to attack it without paying for API fees or risking legal trouble.

• Ollama: Download and install Ollama to run open-source AI models completely offline.
• Garak Scanner: Install the Garak LLM Vulnerability Scanner via your command line to automatically probe your local Ollama models for weaknesses.