DEV Community: Farooq M

Introducing AIGoat 2.0: Hands-On Security Labs for LLMs, RAG, MCP, and AI Agents

Farooq M — Tue, 13 Oct 2026 11:11:00 +0000

AI security is evolving rapidly.

As applications move beyond standalone Large Language Models (LLMs) to Retrieval-Augmented Generation (RAG), connected tools, and autonomous AI agents, the attack surface is expanding.

Prompt injection is only one part of the problem. Tool misuse, excessive agency, untrusted context, and unintended actions introduce new challenges for security engineers and developers.

Understanding these risks requires more than reading about vulnerabilities. We need environments where we can reproduce attacks, investigate their impact, and experiment with defenses.

That is the motivation behind AI Goat 2.0.

We’re excited to introduce the latest evolution of AI Goat, an open-source, hands-on AI security playground designed to help practitioners explore how AI systems can be attacked and defended.

What's New in AI Goat 2.0?

1. MCP Security Labs

The Model Context Protocol (MCP) enables AI applications to interact with external tools and systems. However, these integrations introduce new trust boundaries and security considerations.

AI Goat includes hands-on MCP security labs that help practitioners investigate risks associated with tool interactions, untrusted inputs, and the capabilities exposed to AI systems.

2. Agentic AI Security

AI agents can do more than generate text. They can select tools, interact with application functionality, maintain context, and perform multi-step tasks.

This creates a different security challenge: an attacker may manipulate an agent's behavior rather than simply influence its final response.

AI Goat's agentic security labs provide practical scenarios for exploring these risks and understanding their implications.

3. Agentic Kill Chain Challenge

One of the highlights is the Agentic Kill Chain challenge.

The scenario explores how malicious instructions embedded in seemingly legitimate content can influence an AI agent and potentially lead to unintended actions.

Instead of treating every vulnerability as an isolated issue, the challenge encourages practitioners to investigate how weaknesses can combine across an agent's context, tools, memory, and actions.

This is particularly relevant when evaluating AI assistants connected to business applications, where an apparently harmless interaction can have consequences beyond the model's response.

4. Hands-On Attack-and-Defend Learning

Identifying an attack is only half the work. Security practitioners also need to understand how to reduce its impact.

AI Goat brings attack and defense concepts into a practical learning environment, helping users investigate vulnerabilities, examine evidence, and understand the role of defensive controls.

The objective is to connect offensive testing with actionable defensive thinking.

5. An Expanded AI Security Learning Playground

AI Goat brings together multiple areas of AI application security, including:

LLM security and prompt injection
Retrieval-Augmented Generation (RAG) security
Model Context Protocol (MCP) security
Agentic AI security
Practical attack scenarios and defensive concepts

The goal is to provide a unified environment where developers, application security engineers, penetration testers, AI red teamers, and security researchers can build practical skills.

Why Hands-On AI Security Matters

Consider an AI-powered e-commerce assistant that can search products, retrieve information from documents, access customer context, and interact with business tools.

What happens if an attacker places malicious instructions inside a document the assistant retrieves?

What if those instructions influence tool selection? What if the agent has more permissions than the task requires? What if malicious state persists beyond the original interaction?

These are not merely prompt-engineering questions. They are system security questions involving trust boundaries, authorization, excessive agency, data isolation, and monitoring.

Testing these scenarios in a controlled environment helps security teams reason about the complete attack path instead of focusing exclusively on the model.

That is the kind of practical learning AI Goat aims to support.

Who Is AI Goat For?

AI Goat is intended for people who want to understand AI security through experimentation, including:

Application Security Engineers exploring AI-specific attack surfaces.
Penetration Testers and Red Teamers investigating LLMs, RAG pipelines, MCP integrations, and AI agents.
AI Engineers and Developers building more secure AI-powered applications.
Security Researchers and Students learning about emerging AI threats through hands-on exercises.

Explore AI Goat 2.0

AI Goat is an open-source project, and we welcome practitioners who want to explore the labs, share feedback, report issues, and contribute to improving the learning experience.

💻 GitHub Repository: https://github.com/AISecurityConsortium/AIGoat
🌐 Project Website: https://aigoat.co.in/
🚀 Announcement: https://aigoat.co.in/blog/announcing-ai-goat-v2/
🚨 LinkedIn Announcement: https://lnkd.in/p/d-RSTBNR

If you are working on LLM security, AI red teaming, MCP, RAG, or agentic systems, give AI Goat a try.

Explore the attack paths. Understand the failure modes. Experiment with defenses.

Our goal is simple: make AI security practical, hands-on, and accessible to the security community.

AISecurity #LLMSecurity #AgenticAI #MCP #CyberSecurity #AIGoat #RAG #AIKillChain #AgenticKillChain #KillChain

AIGoat - AI Security Playground to Attack and Defend LLMs. All Running Locally

Farooq M — Thu, 26 Mar 2026 09:45:05 +0000

We built an AI/LLM security playground - AI Goat where anyone from developers to security engineers can run a real AI application locally and start breaking it within minutes.

No cloud setup. No API keys. No complex environment.

Just one command.

Once it’s running, you can:

attack the system
exploit real vulnerabilities
switch between defense levels to see what actually works

All within the same application.

This is what AIGoat is designed for.

Getting Started Guide: https://aigoat.co.in/blog/getting-started-with-aigoat/

Most AI applications today are one prompt away from doing something they were never designed to do.

And the scary part?

Most teams don’t realize it.

A Real Attack: Supply Chain Backdoor

One of the most overlooked risks in AI systems is the supply chain.

In AIGoat, we simulate this using a malicious model configuration.

Here’s what happens:

A model is shared publicly
It looks legitimate
It contains hidden behavioral triggers

When integrated into an application:

A specific phrase triggers data exfiltration
Another exposes internal prompts
Another manipulates business logic

This is not traditional malware.

This is behavioral compromise inside the AI itself.

This Is Not Hypothetical

This is exactly what we demonstrate in AIGoat.

AIGoat is an open-source AI security playground where you can exploit real vulnerabilities in LLM-powered applications.

Not simulations.

Not slides.

A real, intentionally vulnerable AI system.

What Makes This Different?

Most AI security discussions stay at:

theory
best practices
high-level risks

AIGoat flips that model.

You don’t just read about vulnerabilities.

You exploit them yourself

You see how they break

You try to defend them

Covering the OWASP Top 10 for LLMs

AIGoat is designed around the OWASP Top 10 for LLM Applications.

Instead of just listing them, we:

Turn each category into a hands-on lab
Provide real attack scenarios
Let you test defensive controls

You can explore all of them in one place.

As far as we know, there are very few platforms that allow you to:

Learn
Exploit
Defend

all major LLM vulnerabilities end-to-end

What You Get Inside AIGoat

17 hands-on attack labs
9 CTF-style challenges (auto-graded)
Multiple defense levels
Fully local setup (no cloud, no API keys)

You’re interacting with a real AI-powered e-commerce application, not a toy example.

Why This Matters

AI is being integrated into:

customer support
financial workflows
internal tools
decision systems

But the security mindset hasn’t caught up.

We’re still treating AI like:

“just another API”

It’s not.

It’s a dynamic, behavior-driven system that can be manipulated in ways traditional systems cannot.

Try It Yourself

Getting Started Guide: https://aigoat.co.in/blog/getting-started-with-aigoat/

If you're:

building with LLMs
securing AI systems
learning red teaming

Spend 30 minutes with AIGoat.

It will change how you think about AI security.

Get Started

Website: https://aigoat.co.in

GitHub: https://github.com/AISecurityConsortium/AIGoat

Final Thought

We don’t need more checklists for AI security.

We need more people who have actually broken AI systems and understand how they fail.

That’s what AIGoat is built for.

Feedback Welcome

If you try it:

break things
explore the labs
share feedback

We’re actively evolving the platform.

Star the repo. A GitHub star costs nothing and means everything. It helps other security practitioners discover the project.