GIAC AI Penetration Tester

Attack techniques follow from how models read their input. You learn how prompts, system instructions and context are assembled, why a model cannot reliably separate instructions from data, and the tools a tester uses to probe and record behavior.

• Tokens, context windows and prompt assembly
• System, developer and user instructions
• Why instructions and data blur together
• Common AI testing tools and what each measures
• Sampling settings and repeatable testing
• Recording results so they can be reproduced

You build A repeatable test harness that records prompts, settings and responses for one model.

You cannot test what you have not found. You identify AI services in an environment, enumerate the endpoints, tools and data they expose, and learn how filters and monitoring shape what a tester sees.

• Finding AI services and endpoints in an environment
• Enumerating features, tools and connected data
• Reading error messages and metadata for clues
• Understanding input and output filters
• What evasion means in the context of AI controls
• Building an attack surface map

You build An attack surface map for an AI-enabled application, with every exposed input and tool.

Direct prompt injection is the most visible weakness of language model applications. You study the widely used techniques that change a model’s behavior through user input, measure how often they work, and propose defenses that hold.

• Direct prompt injection: patterns and why they work
• Role, context and instruction manipulation
• Extracting instructions and sensitive context
• Measuring success rates with repeated trials
• Input filtering and its weaknesses
• Defense in depth for direct input

You build A tested catalog of direct input weaknesses in a lab application, each with a recommended control.

A model that reads documents, web pages or email can be steered by the content itself. You examine how content a model processes on its own changes its behavior, which pipelines are exposed, and how to contain the impact.

• Indirect injection through documents, pages and email
• Hidden and encoded instructions in content
• Exposure in retrieval and browsing features
• Data exfiltration paths through model output
• Testing ingestion pipelines safely
• Containment: privilege limits and output controls

You build A test of one model pipeline with indirect injection results and the containment it needs.

Models drift from their intended behavior in predictable ways. You recognize the common failure types, test for them in a structured way, and separate behavior that is only embarrassing from behavior that is a security impact.

• Common model failure modes: jailbreak, leakage and over-compliance
• Hallucination and fabricated actions or sources
• Bias and unsafe content as business risk
• Structured testing for alignment failures
• Rating impact for a given deployment
• Mitigations: tuning, moderation and design limits

You build An alignment test report for one model, with failures rated by impact for its deployment.

Modern AI systems combine models, agents, orchestration layers and tool servers, each trusting the next. You map those trust relationships, find where one compromised part can use another, and test how permissions and approvals hold up.

• Agent systems and orchestration layers
• MCP servers and tool connection design
• Trust relationships between agents and tools
• Confused deputy and privilege problems in agent chains
• Testing permissions, approvals and tool authorization
• Reporting architectural weaknesses clearly

You build A trust map and test results for a multi-agent system with tool servers.

The model sits inside ordinary infrastructure with ordinary weaknesses. You identify which model or product is behind a service, and test the processes around it, including serving, storage, access and update workflows.

• Fingerprinting models and serving stacks
• Weaknesses in model hosting and API configuration
• Secrets, logs and storage around a model
• Update, deployment and supply chain steps
• Abuse of cost and rate controls
• Combining AI and classic findings in one report

You build An infrastructure assessment of an AI service that combines model and classic findings.

Test one AI-enabled application from scope to report. You map its surface, assess input, alignment, architecture and infrastructure, and write findings that name the impact and the fix for each.

• Scoping and mapping the application
• Testing direct and indirect input
• Testing agents, tools and infrastructure
• Rating impact and writing findings
• Presenting results to engineers and owners

You build A complete AI penetration test report with evidence, impact ratings and remediation advice.