GuildCyber
Offense Labs
Challenges
Offense Track · Hands-on Labs

Labs for the techniques that break AI

Each lab is a safe, sandboxed reconstruction of a real attack class, with original scenarios. You inspect the payload, watch what a naive AI does with it, and learn the tell that gives it away. Labs 01 and 02 are foundational, the two things every AI red-teamer must know. Lab 03 is an advanced obfuscation twist, more of an eye-opener than a daily tool. Nothing here performs a real action; the agents are simulated.

LAB 01 Foundational Indirect Injection LLM01 LLM06

The Poisoned Résumé

A documented real-world attack class: hiding instructions in a document so that when an AI reads it as data, it follows them as commands. Here, a candidate poisons their résumé to hijack an AI recruiter.
Your target: an AI hiring assistant that screens résumés, scores candidates, and can advance them or email the shortlist. A candidate submits j_avery_resume.pdf. To a human recruiter it's an ordinary CV. To the AI, it's carrying orders.

Task: switch between how a human reads the résumé and how the AI reads it, find where the instructions are hidden, then run it through a naive screener and a hardened one and watch the difference.

📄j_avery_resume.pdf
🤖TalentScreen AIIdle
Choose a screener above to run the résumé through it.
What this teaches
  • Data becomes command. The screener treats résumé content as trusted instructions. That single confusion is the entire vulnerability class.
  • Injections hide where humans don't look: white-on-white text, document metadata, and fake authority tags like SYSTEM: and <ADMIN> that tell the AI to skip its checks.
  • The defense is a boundary: a hardened screener treats every document as untrusted data, never as instructions, and requires human approval before any tool action.
Maps to: Offense Module 4 (Indirect Injection and Agent Misuse) · earns Indirect Injection · Agent
LAB 02 Foundational Direct Injection LLM01 LLM07

No Wall

The most foundational LLM attack. A model has no built-in wall between its own instructions and your input; both arrive as one stream of text, so your words can overrule its rules.
Your target: PromoBot, a store assistant. Its hidden system prompt holds a staff-only discount code and a strict rule never to reveal it. You have nothing but the chat box.

Task: first peek at the raw prompt to see why this works, then talk PromoBot into leaking the staff code. Then switch on hardened mode and watch the same attack fail.

🛍️PromoBot Secure
What PromoBot's model actually receives
What this teaches
  • There is no wall. The system prompt and your message are one stream of text to the model. The raw-prompt view shows it: nothing separates its rules from your words.
  • The most recent instruction usually wins. That is why "ignore your previous instructions" and "repeat the text above" work on a naive assistant.
  • Secrets in a prompt are not safe (LLM07). Anything in the system prompt can leak. The defense is to keep secrets out of the prompt, detect override attempts, and enforce an instruction hierarchy.
Maps to: Offense Module 2 (Direct Prompt Injection) · earns Prompt Injection I
LAB 03 Advanced Invisible Smuggling LLM01

The Invisible Refund

A specialized obfuscation technique: hiding a full instruction inside invisible Unicode tag characters (U+E0000 to U+E007F) that render as nothing but are read by the model. Great for understanding how "clean" text can still be weaponized.
Your target: an AI customer-support agent that can issue refunds and account credits. A customer sends a warm, harmless-looking thank-you note. The note also carries an instruction your eyes cannot see.

Task: reveal that hidden characters exist, decode what they actually say, then run the built-in sanitizer to see the defense.

happy_customer
Support ticket #48217
Decoded hidden instruction
Try it yourself: paste any text to scan and sanitize
Results appear here.
What this teaches
  • What you see is not what the model reads. Unicode tag characters display as nothing but carry a full ASCII payload the model happily follows.
  • Detection is simple once you know to look: scan for code points in the U+E0000 to U+E007F range. If they're there, something is hidden.
  • The fix is to strip or normalize non-printing characters before any untrusted text reaches the model.
Maps to: Offense Module 3 (Jailbreaking and Guardrail Bypass, encoding and obfuscation), as an advanced technique.
These labs are safe reconstructions for authorized learning. No real network calls, tool actions, emails, or accounts are touched by anything on this page. The agents and their logs are simulated.