Free hands-on CTFs where you attack live LLM agents: prompt injection, tool abuse, RAG poisoning, and more. Built for security pros and AI engineers who want to understand how AI systems actually break, not just read about it.

Sydekiq — Your own AI agent, deployed on a private server, 24/7

Your own AI agent, deployed on a private server, 24/7

Hey Product Hunt 👋 I'm Anthony — security consultant, PhD, eCPPT. There's a real gap between "everyone is shipping LLM agents" and "almost no one has hands-on experience breaking one." Most training in this space is either a blog post or a static CTF with a hardcoded flag. I wanted something different. Wraith Academy is my attempt at that. It's free, fully hands-on in the browser, and every challenge pits you against a live LLM agent — you're actually getting an AI to do something it shouldn't, not just matching a known payload. Current challenges cover prompt injection, tool abuse, and RAG poisoning, with more on the way. Who it's for: pentesters moving into AI, AI/ML engineers who want to see their own attack surface, CTF players looking for something new. I'll be in the comments all day. Would especially love feedback on challenge difficulty and what you'd want to see next.

Curious what the PH community thinks. There's a lot of noise about LLM safety, but "safety" and "security" get conflated constantly, and the actual attack surface on an agent in production is its own thing.

From where I sit, the most under-addressed failure modes seem to be:

Indirect prompt injection via retrieved content (RAG sources, tool outputs, even user-uploaded docs)
Tool/function abuse where the agent happily calls something it shouldn't
Trust boundaries between the agent and the systems it can touch

From where I sit, the most under-addressed failure modes seem to be:

Indirect prompt injection via retrieved content (RAG sources, tool outputs, even user-uploaded docs)
Tool/function abuse where the agent happily calls something it shouldn't
Trust boundaries between the agent and the systems it can touch

Sydekiq — Your own AI agent, deployed on a private server, 24/7

Your own AI agent, deployed on a private server, 24/7

Wraith Academy

Learn AI pentesting by attacking real LLM agents

Learn AI pentesting by attacking real LLM agents

Forum Threads

What's the weakest part of AI agent security right now?

Forum Threads

What's the weakest part of AI agent security right now?