📰 Originally published on Securityelites — AI Red Team Education — the canonical, fully-updated version of this article.
🤖 AI/LLM HACKING COURSE
FREE
Part of the AI/LLM Hacking Course — 90 Days
Day 27 of 90 · 30% complete
⚠️ Authorised Targets Only: AI Red Team Operations techniques covered in Day 27 require explicit written authorisation. The engagement planning methodology here applies only to authorised security assessments conducted within agreed scope boundaries.
The best AI red team engagement I ever ran lasted four and a half days. The worst one I ever ran lasted four and a half days. Same duration. Completely different results — not because the second target was harder, but because the planning was worse. The first engagement had a clear threat model before the first test request was sent. The second one didn’t. We spent time testing attack categories that weren’t relevant to the target’s actual risk profile, missed an entire endpoint cluster during the recon phase because we jumped to exploitation too quickly, and produced a report that accurately documented what we’d tested rather than what actually mattered.
The difference between a good AI red team engagement and a thorough waste of everyone’s time is almost entirely in the planning. What the target is. Who would attack it and why. What the most likely attack paths are for that specific adversary profile. Which techniques to run first because they’ll produce the most significant findings. How to structure the testing window so the high-impact work gets done before the deadline. Day 27 covers the complete engagement methodology — the operational layer that turns the technical skills from Days 16 through 26 into a coherent, professional engagement.
🎯 What You’ll Master in Day 27
Build an AI-specific threat model that drives attack family prioritisation
Write rules of engagement that cover the AI-specific considerations most generic RoE templates miss
Structure a phased attack execution plan from recon through delivery
Manage evidence and findings in real time rather than reconstructing at the end
Design the testing timeline for different AI deployment types and scope sizes
Deliver findings with both written and verbal components that technical teams can act on
⏱️ Day 27 · 3 exercises · Think Like Hacker + Think Like Hacker + Kali Terminal ### ✅ Prerequisites - Day 25 — AI Security Report Writing — the report format from Day 25 is the output artifact of the Day 27 engagement methodology; understand the deliverable before planning how to produce it - Days 20–24 — the complete attack toolkit from the Phase 2 and 3 modules; Day 27 orchestrates these techniques, not introduces them - Familiarity with basic penetration testing engagement structure — scope, rules of engagement, and report delivery concepts ### 📋 AI Red Team Operations — Day 27 Contents 1. Building the AI Threat Model 2. Rules of Engagement — AI-Specific Considerations 3. The Phased Attack Execution Plan 4. Timeline Design for Different Scope Sizes 5. Real-Time Evidence Management 6. Engagement Delivery — Written and Verbal In Day 26 you covered the pre-deployment attack surface. Day 27 covers how to structure an engagement that tests the full attack surface — supply chain through inference — in a coherent, professional sequence. Day 28 covers adversarial ML attacks: the techniques that operate at the model layer itself, below the application layer that Days 4 through 26 primarily targeted.
Building the AI Threat Model
Threat modelling for AI systems has the same structure as threat modelling for any system — identify assets, identify adversaries, map attack paths — but the specific assets and adversaries are different enough that generic threat model templates don’t capture the AI-specific risks well. The assets include the model weights, the training data, the system prompt, the RAG knowledge base, and the tool integrations. None of these appear in a standard STRIDE template.
The adversary profiles that matter for AI systems: external users attempting to extract value by abusing the AI’s capabilities, insider threats with access to the AI’s configuration or data pipelines, supply chain adversaries targeting the model before deployment, and indirect attackers who can influence the content the AI processes (via document upload, email, or web content that the AI reads). Each profile has different access, different objectives, and maps to different attack families. A public-facing customer service AI has primarily external user threats. An enterprise internal assistant has significant insider threat and indirect injection surfaces.
AI THREAT MODEL TEMPLATECopy
AI Threat Model — fill in per engagement
Assets
Model weights + system prompt: ______________
Training / fine-tune data: ___________________
RAG knowledge base contents: ________________
Tool integrations (list each): _______________
User conversation data: _____________________
Adversary Profiles
External user (authenticated): YES / NO
External user (unauthenticated): YES / NO
Insider (employee / contractor): YES / NO
Supply chain (model / package): YES / NO
Indirect (doc/email injection): YES / NO
Attack Path Mapping (per adversary profile)
External user → prompt injection → system prompt extraction → credential use
External user → jailbreak → restricted content access
Insider → RAG poisoning → persistent misinformation for all users
Indirect → document injection → agent tool hijacking → data exfil
Priority Attack Families (derived from above)
- LLM01 Injection (all external user paths)
- LLM06 Agent (all tool integration paths)
- LLM08 RAG (all insider / indirect paths)
📖 Read the complete guide on Securityelites — AI Red Team Education
This article continues with deeper technical detail, screenshots, code samples, and an interactive lab walk-through. Read the full article on Securityelites — AI Red Team Education →
This article was originally written and published by the Securityelites — AI Red Team Education team. For more cybersecurity tutorials, ethical hacking guides, and CTF walk-throughs, visit Securityelites — AI Red Team Education.
Top comments (0)