ON-DEMAND

Pwned Labs AI Systems Attack & Defense Bootcamp - Professional Edition

AISRTP stands for AI Systems Red Team Professional.

Launches 20 October. Early bird pricing: $349 until launch, then $399.

Hands-on AI and agentic attack and defense training focused on real-world attack paths across LLM applications, RAG pipelines, and agentic systems.

Ideal for: application security engineers, penetration testers, security consultants, red and purple teamers, detection engineers, and developers shipping LLM-backed features. No prior AI security experience required.

Designed for modern LLM-backed and agentic applications, teaching operators to execute the tradecraft and assess AI-driven workflows end-to-end

Enroll now

AI systems are much more than just a chatbot!

This on-demand bootcamp and structured learning path teaches practical techniques for attacking and defending LLM-backed and agentic applications. You will work through prompt injection, RAG poisoning, tool and agent abuse, and MCP and CI/CD agent attack paths using techniques drawn from real AI security assessments.

After completing the bootcamp and associated learning path, you will validate your skills in the AI Security Red Team Professional (AISRTP) exam: fully hands-on, unproctored, and requiring an end-to-end exploitation chain.

The exam environment is dynamic, with scenarios changing regularly to reflect real-world AI and agentic attacks and ensure certification credibility.

Prerequisites and key learning outcomes

You should be comfortable with HTTP, reading JSON, and using the command line. Familiarity with curl and the command line helps. Lab guides give every command in full, so no Python is required.. No prior AI security experience is required.

After completing the bootcamp and passing the exam, you will demonstrate proficiency in:

Understanding how LLM applications, RAG pipelines, and agentic systems are built and where they break
Identifying and exploiting direct and indirect prompt injection in shipped LLM applications
Poisoning RAG across documents and tickets, understanding what an exposed embedding store gives away, and making retrieval attacks reliable
Finding tool-abuse and excessive-agency paths in agentic systems and reducing their blast radius
Tracing agentic compromise across CI/CD agents and MCP-connected tool servers
Detecting AI attacks in telemetry: prompts, tool calls, and the side effects they cause
Applying the same tradecraft across AWS Bedrock, Azure AI Foundry, Google Agent Platform, and self-hosted stacks
Evidencing an attack chain end to end: message-level proof, developer-side root causes, and the detections that would have caught it

What you get

You get ongoing access to the full AI and agentic security curriculum, organized into four pillars that align to the four sessions. Each pillar includes its own learning path so you can hit the ground running before the session starts.

Lifetime access to the latest session recordings, updated slides and command guides, bootcamp labs, and all future course updates
45 days of Academy lab access for the learning paths tied to each session, starting from when you redeem your voucher rather than from purchase, with no deadline to claim and extendable with subscription
Direct preparation for the AISRTP certification exam
More information on the bootcamp, learning paths, and the AISRTP exam is available here

Focus on trending techniques and tradecraft

The Pwned Labs AI Systems Attack & Defense Bootcamp - Professional Edition covers attacker tradecraft drawn from real AI and agentic security assessments, generalized into vendor-neutral, teachable patterns, including activity attributed to groups such as TeamPCP, whose Mini Shai-Hulud worm hijacks CI/CD pipelines and targets AI coding agents. Labs simulate realistic LLM-backed and agentic applications with live tools, retrieval, and agent workflows.

You will learn how to:

Reproduce tradecraft from real AI and agentic findings
Execute attacks using current AI red-team tooling and manual tradecraft
Design controls and detections that reduce blast radius

Course syllabus

4 sessions9 hands-on labs plus a capstone CTF24-hour hands-on exam2 exam attempts$349 early bird (then $399)Launches 20 October

The Pwned Labs AI Systems Attack & Defense Bootcamp (AISRTP) is a hands-on, on-demand red team course for LLM-backed and agentic applications. Across four sessions you work real attack paths through prompt injection, RAG and knowledge-base poisoning, tool abuse and excessive agency, and agentic, CI/CD and MCP attacks, then defend each one, before validating your skills in a 24-hour, fully hands-on exam. No prior AI security experience is required.

Session 1: Direct prompt injection and disclosure

How a shipped LLM application is built: the model, the system prompt, retrieval, and tool interfaces, and where user input collides with instructions
Recon and fingerprinting: confirming an app is LLM-backed and identifying the model and stack
Direct prompt injection: instruction and data collision, instruction precedence, and insecure defaults
System-prompt disclosure, and why the system prompt is not a security boundary
Automated assessment with industry tools: Garak, PyRIT, and Promptfoo

Session 2: Indirect injection and RAG poisoning

How retrieval-augmented generation (RAG) works and where it breaks
Indirect prompt injection through documents, records, and knowledge bases the assistant already trusts
Making poisoning reliable and getting past output filters and guardrails
Escalating a content-level injection into cloud compromise, including leaked cloud tokens and remote code execution
Defense: keeping untrusted content out of trusted stores and scoping identities

Session 3: Tool abuse and excessive agency

The tool-calling threat model: the model decides, the server executes, and the trust boundary the model cannot see
Coercing sensitive calls, shaping arguments, and chaining tools out of scope
The API behind the bot: object-level and function-level authorization and mass assignment (BOLA, BFLA)
Natural-language IDOR against a customer-service agent, the confused-deputy problem
Poisoning an AI build pipeline to gain code execution in CI and reach production
Blue-team view: designing down the blast radius and the telemetry to detect tool abuse

Session 4: Agentic workflows, CI/CD, and MCP

From a single agent to a pipeline of agents, and the identity a workflow runs as
Agentic risk in CI/CD: pull-request and build text as an attack surface
MCP (Model Context Protocol) as a supply chain: tool-description poisoning, command injection in tool transports, and message-layer weaknesses
Reproducing a self-propagating agent supply-chain worm, in the style of the Shai-Hulud campaign, and detecting it from cloud telemetry
Detection engineering across AWS, GCP, and Azure
Capstone CTF chaining one weakness from each session into a single end-to-end path

Related concepts in our Security A-Z glossary: indirect prompt injection, AI red teaming, cloud detection engineering, and cloud incident response.

Ian Austin is a security researcher and educator with a career spanning over 20 years in technical, security and leadership roles for global enterprises.

Ian was Head of Content at Hack The Box, a leading online platform for cybersecurity training and assessment. He also participated in the Green Team of Locked Shields, a NATO cyber defense exercise, contributing to the design and execution of realistic scenarios.

He is the founder of Pwned Labs, providing gamified and immersive cloud security labs for red and blue teams.

How it works

Start immediately with on-demand access. Work through the learning path and labs at your own pace. Your purchase includes 45 days of lab access and two AISRTP exam attempts. The 45 days begins when you redeem your voucher rather than at purchase, and there is no deadline to claim it. Lab access is extendable with subscription. Support is available via Discord.

What security teams say

“The Pwned Labs bootcamps are well structured and strongly focused on practical application. The team demonstrates both sides by walking through attacks and the corresponding defenses, backed by hands-on labs. The red-team labs are challenge-driven, with clear walkthroughs that explain each step and the underlying logic.”

Dani Schoeffmann, Security Consultant, Pen Test Partners

“I’ve worked in security for more than 15 years, and Pwned Labs’ bootcamps and labs are among the best I’ve experienced. As a highly technical person, I get the most value from structured, hands-on education where theory is immediately reinforced through labs.”

Matt Pardo, Senior Application Security Engineer, Fortune 500 company

Ask your employer to fund AISRTP

Need employer funding approval? Use our ready-made employer funding request to outline the value of the Pwned Labs AI Systems Attack & Defense Bootcamp - Professional Edition and the AISRTP certification.

Prefer to self-fund? You can enroll immediately.

Download employer funding request

Frequently asked questions

What is the AISRTP bootcamp?

The Pwned Labs AI Systems Attack & Defense Bootcamp (AISRTP) is a hands-on, on-demand course covering attack and defense for LLM-backed and agentic applications. It teaches prompt injection, RAG poisoning, and tool, agent, and MCP attack paths, then certifies you through the AI Systems Red Team Professional exam.

What does AISRTP stand for?

AISRTP stands for AI Systems Red Team Professional. It is the hands-on certification earned by completing the bootcamp and passing the exam.

Do I need AI security experience to take the AISRTP?

No prior AI security experience is required. You should be comfortable with HTTP, reading JSON, and the command line. The bootcamp starts with how LLM and agentic systems are built and where they break, then builds toward advanced attacks.

What does the AISRTP cover?

The bootcamp covers direct and indirect prompt injection, RAG and knowledge-base poisoning, tool abuse and excessive agency, and agentic, CI/CD and MCP attack paths. You assess apps with industry tools including Garak, PyRIT, and Promptfoo, escalate injections to cloud remote code execution, and build detections across AWS, GCP, and Azure.

How long is the AISRTP exam and is it proctored?

Once started you have 24 hours to complete an end-to-end exploitation chain from a provided entry point to capture the flag, in a live environment of LLM-backed and agentic applications. The exam is fully hands-on, unproctored, and requires no pentest report.

When does the AISRTP bootcamp launch and what does it cost?

The bootcamp launches on 20 October. Early bird pricing is $349 until launch, then $399. Enrolling early locks in the early bird price.

How is AISRTP different from other AI security training?

Most AI security training is conceptual or governance-focused. AISRTP is an offensive, fully hands-on certification earned by operating against live AI and agentic systems, covering the prompt injection, retrieval, and agentic abuse that defines real AI compromise.

Pwned Labs AI Systems Attack & Defense Bootcamp - Professional Edition

Pwned Labs AI Systems Attack & Defense Bootcamp - Professional Edition Overview