Hey Product Hunt 👋 I'm Anthony — security consultant, PhD, eCPPT. There's a real gap between "everyone is shipping LLM agents" and "almost no one has hands-on experience breaking one." Most training in this space is either a blog post or a static CTF with a hardcoded flag. I wanted something different. Wraith Academy is my attempt at that. It's free, fully hands-on in the browser, and every challenge pits you against a live LLM agent — you're actually getting an AI to do something it shouldn't, not just matching a known payload. Current challenges cover prompt injection, tool abuse, and RAG poisoning, with more on the way. Who it's for: pentesters moving into AI, AI/ML engineers who want to see their own attack surface, CTF players looking for something new. I'll be in the comments all day. Would especially love feedback on challenge difficulty and what you'd want to see next.

Forum Threads

p/wraith-academy

•

4mo ago

What's the weakest part of AI agent security right now?

Curious what the PH community thinks. There's a lot of noise about LLM safety, but "safety" and "security" get conflated constantly, and the actual attack surface on an agent in production is its own thing.

From where I sit, the most under-addressed failure modes seem to be:

Indirect prompt injection via retrieved content (RAG sources, tool outputs, even user-uploaded docs)
Tool/function abuse where the agent happily calls something it shouldn't
Trust boundaries between the agent and the systems it can touch

View all

Wraith Academy

Learn AI pentesting by attacking real LLM agents

Learn AI pentesting by attacking real LLM agents

Forum Threads

What's the weakest part of AI agent security right now?

Forum Threads

What's the weakest part of AI agent security right now?