Skip to content
AI Goat - AI Security Playground AI GoatTM
100 45 3
Star on GitHub
NEW v2.0: MCP & agentic AI labs

AI GoatTM Open Source AI Security Playground for AI Red Teaming

AIGoat is the open-source AI security playground where you learn to exploit and defend AI systems through hands-on attack labs. AI Goat v2.0 goes beyond the chatbot: prompt injection, RAG poisoning, MCP tool poisoning, and attacks on tool-calling AI agents and their memory, mapped to the OWASP Top 10 for LLM, Agentic and MCP applications.

No cloud setup, no API keys, no model subscriptions. Runs entirely offline.
Explore AIGoat Labs View AIGoat on GitHub
46 Attack Labs LLM · RAG · MCP · Agents 3 Defense Levels 9 CTF Challenges
Labs mapped to OWASP LLM Applications 2026 OWASP Agentic Applications 2026 OWASP MCP Top 10 beta

Open source, built by the AI Security Consortium

What's new in v2.0

The model is only one way in.

AI applications don't just answer questions anymore. They retrieve documents, connect to MCP servers, call tools and remember what they saw. An attacker can plant instructions in any of those places. AIGoat v2.0 is rebuilt around those surfaces. It now ships 46 hands-on labs.

  • MCP01–MCP10 · 11 labs

    MCP security labs

    Attack a real MCP client. It talks JSON-RPC over stdio to four servers: official, community, untrusted and internal. The labs cover tool-description poisoning, rug-pull redefinitions, schema drift, lookalike servers, token passthrough and session forensics.

    Where in the app: Console → MCP

  • ASI01–ASI10 · 12 labs

    Agentic AI labs

    Give the shop agent a goal and watch which tool it calls. There is a lab for every OWASP Agentic risk, including goal hijack, tool misuse, privilege abuse, memory poisoning, exploiting human approval, and a sandboxed shell executor.

    Where in the app: Console → Agent

  • Capstone

    Agentic Kill Chain

    Hide an instruction in a product review or an invoice PDF. Follow it into connector memory, then agent memory, then a tool call that mails customer data to a simulated attacker inbox. Then replay it in Defended and Guardrailed modes.

    Where in the app: Try → Challenges

  • 7 RAG labs · LLM01 · LLM02 · LLM09

    RAG you can inspect

    Knowledge-base documents now carry provenance and a trust tier, and hybrid BM25 plus vector retrieval is available as an option. Poison a document, then read the retrieval trace to see what was ranked, dropped and placed in the prompt.

    Where in the app: Console → RAG

  • 19 controls · L0 / L1 / L2

    Defenses per surface

    Each defense level is built from controls chosen for that attack surface. They include tool and schema pinning, allowlists, description and result scanning, memory scanning and human approval. Run traces show which controls ran.

    Where in the app: Every lab

  • 6 scenarios

    Threat modeling workbench

    Threat-model AIGoat's own architecture. Use the interactive diagram, a guide to methods from STRIDE and PASTA to MITRE ATLAS and NIST AI RMF, and six worked scenarios.

    Where in the app: Learn → Threat Modeling

Inside the playground

One shop, four attack surfaces.

Every lab runs against the same application, AI Goat Shop. Its chatbot, knowledge base, MCP integrations and operations agent work with the same products, reviews, tickets and customers. That shared data is how one poisoned review can end up steering the operations agent.

Pick a framework, pick a risk, open a lab

Every lab maps to one risk code in the OWASP LLM, Agentic or MCP list. Each one comes with a goal, starter prompts, hints and the expected result at every defense level. Cracky, the shop's chatbot, is still the target for the classic LLM labs.

AIGoat v2.0 Attack Labs hub showing LLM 2026, MCP 2025 and Agentic 2026 framework tabs with per-risk lab counts

Investigate the client, then submit evidence

Identify the server, list its tools and run them. Every request and response goes into the interaction history. A lab only finishes when the evidence you cite supports your conclusion.

AIGoat v2.0 MCP03-1 Tool Description Poisoning lab with MCP Interaction History, Server identity and Submit evidence panels

The tool call is the exploit

Plant a standing note, send the agent a goal and read the transcript. Labs score the tool_call the agent actually made, not what it said in its reply. Then raise the level and work out which stage changed.

AIGoat v2.0 ASI06-1 Memory Poisoning lab showing the objective, steps, goal input and standing shop notes

Poison the knowledge base, then trace retrieval

Add a normal document, sync the vector index and ask about it. Then add a poisoned one. The retrieval trace shows what was ranked, what was dropped and what reached the prompt.

AIGoat v2.0 RAG page with knowledge documents, trust-tier filter, retrieval trace tab and index pipeline status

Model the system you just attacked

An interactive architecture diagram of AIGoat itself, a guide to choosing a framework for each question, and six worked scenarios that run from the threat through to its mitigations.

AIGoat v2.0 Threat Modeling workbench introduction with architecture, frameworks, scenarios and mitigations path

Capstone · ASI06 · ASI01 · ASI02 · LLM01

One poisoned review. A compromised agent.

The Agentic Kill Chain isn't a one-shot prompt injection. It teaches how a planted instruction persists across two memory stores and comes back days later as an action nobody asked for.

  1. 1

    Plant

    Hide an instruction in a product review (an HTML comment) or in a PDF attached to a support ticket.

  2. 2

    Ingest

    A naive ingestion pipeline pulls out the hidden text and writes it to connector memory.

  3. 3

    Persist

    The agent turns that record into standing notes in its own long-term memory.

  4. 4

    Retrieve

    Later, a routine admin question pulls the matching note into context.

  5. 5

    Act

    The model picks a tool. Customer data goes to the attacker inbox, or a checkout drops to $1.00.

  6. 6

    Defend

    Defended mode keeps the poison but holds each sensitive operation for an administrator approval bound to the exact arguments. Guardrailed adds rails an approval cannot override: an egress allowlist, card masking, a staff-coupon rule and an ingestion scan.

AIGoat v2.0 Agentic Kill Chain workbench: the review-poisoning attack source with a hidden-instruction field, and the Agentic Cracky operations agent answering a ticket summary request
The kill chain workbench: attack sources on the left, the shop's operations agent on the right. Below them are a memory inspector, the execution trace and the attacker inbox.

The lesson most people miss

Clearing the agent's memory doesn't fix it. The connector still holds the original text, and the next request copies it straight back.

Staff-only lab. All data is synthetic, and the "email" is a database row. It needs a local model that supports tool calls. If the model ignores the planted note, the trace says so instead of faking the impact.

How it works

Attack. Defend. Prove it.

Every lab runs the same loop. No defense is absolute, so the point is to learn exactly where each one breaks.

  1. 01

    Run it locally

    Start it with one script or Docker Compose. Ollama serves the model on your own machine, and nothing is sent to a cloud API.

  2. 02

    Attack a surface

    Choose a chat, RAG, MCP or agent lab. Each one gives you a goal, starter prompts, hints and the result to expect.

  3. 03

    Raise the defenses

    Replay the same attack at L0 Vulnerable, L1 Hardened and L2 Guardrailed. Find which control stopped it, and what still gets through.

  4. 04

    Prove it with evidence

    Server-side evaluators decide completion. They check a recorded tool call, an MCP exchange you cite, or a per-user challenge flag. A convincing reply isn't enough.

L0 Vulnerable: no controls. The attack should land.

L1 Hardened: input validation, intent classification, output moderation, tool allowlists and pinning.

L2 Guardrailed: adds NeMo Guardrails rails, human approval, memory scanning and MCP checks.

Coverage

Mapped to three OWASP lists.

Every lab has one primary risk code, and lab pages also tag the related risks in the other lists. v2.0 follows the 2026 numbering of the OWASP LLM Top 10, so some codes no longer match the 2025 list.

OWASP Top 10 for LLM Applications

2026 edition

23 labs

  • LLM01 Prompt Injection 5
  • LLM02 Sensitive Information Disclosure 4
  • LLM03 Excessive Agency 3
  • LLM04 Supply Chain 1
  • LLM05 Data and Model Poisoning 1
  • LLM06 Unbounded Consumption 1
  • LLM07 Misinformation 1
  • LLM08 Hidden Context Exposure 1
  • LLM09 Vector and Embedding Weaknesses 5
  • LLM10 Improper Output Handling 1

OWASP Top 10 for Agentic Applications

2026 edition

12 labs

  • ASI01 Agent Goal Hijack 1
  • ASI02 Tool Misuse and Exploitation 1
  • ASI03 Identity and Privilege Abuse 1
  • ASI04 Agentic Supply Chain Vulnerabilities 1
  • ASI05 Unexpected Code Execution 1
  • ASI06 Memory & Context Poisoning 3
  • ASI07 Insecure Inter-Agent Communication 1
  • ASI08 Cascading Failures 1
  • ASI09 Human-Agent Trust Exploitation 1
  • ASI10 Rogue Agents 1

OWASP MCP Top 10

Beta list, codes may change

11 labs

  • MCP01 Token Mismanagement & Secret Exposure 1
  • MCP02 Privilege Escalation via Scope Creep 1
  • MCP03 Tool Poisoning 3
  • MCP04 Supply Chain Attacks & Dependency Tampering 1
  • MCP05 Command Injection & Execution not built
  • MCP06 Intent Flow Subversion 1
  • MCP07 Insufficient Authentication & Authorization 1
  • MCP08 Lack of Audit and Telemetry 1
  • MCP09 Shadow MCP Servers 1
  • MCP10 Context Injection & Over-Sharing 1

MCP05 (command injection) is deliberately not an MCP lab: AIGoat keeps its vulnerabilities in the AI layer, not the host OS. Code execution is covered as ASI05 instead, inside a disposable, network-less Docker sandbox. The figures are lab counts by primary risk in the v2.0 release candidate.

CTF challenges

Then test yourself without the hints.

9 CTF-style challenges on prompt injection, system prompt extraction, knowledge-base poisoning, multi-turn escalation and guardrail erosion, worth 2,100 points in total.

  • Per-user flags. Each flag is an HMAC of the challenge and your user ID, so it can't be shared or reused.

  • Exploit-gated. A server-side evaluator has to see the exploit happen before it releases the flag.

View challenges
4

Beginner

4 challenges

100–150 pts
5

Intermediate

5 challenges

200–500 pts

The Agentic Kill Chain workbench also opens from the Challenges page.

Get started

Run the playground on your machine.

Then open http://localhost:3000. Log in as alice, or use Switch to Admin for the staff-only RAG, admin assistant and kill chain labs.

Local script

Python 3.11, Node.js 18+, Ollama 
$ git clone https://github.com/AISecurityConsortium/AIGoat.git$ cd AIGoat$ ./scripts/start.sh

Pulls Mistral if missing, applies migrations, seeds demo data, then starts the backend and frontend.

Docker Compose

Docker Desktop with 12 GB+ RAM allocated 
$ git clone https://github.com/AISecurityConsortium/AIGoat.git$ docker volume create ollama_models$ cd AIGoat/docker && docker compose up --build

Starts three containers: Ollama, the backend and an Nginx frontend. The model downloads once into the volume.

Agent, MCP host and kill chain labs need a tool-calling model

Mistral is the default and covers the chat and RAG labs. For tool-calling labs, pull a model with native tool calls, for example ollama pull qwen3.5:9b, and pick it in the console. Plan for about 8 GB of free RAM. A GPU is optional but makes replies much faster.

Deliberately vulnerable. Keep it isolated.

Run AIGoat on your own machine or on an isolated lab network, and never expose it to the internet. The Docker setup publishes its ports on all interfaces so that other machines on your network can reach it.

Full setup guide on GitHub No local machine? Run it in Google Colab Read the getting started guide

Who it's for

Built for people who secure AI systems.

  • Security engineers & red teamers

    Practise the attack paths you will meet in AI assessments, from prompt injection to MCP tool poisoning and agent memory abuse.

  • AI, RAG and agent builders

    See how retrieval, MCP integrations and tool-calling agents fail before you ship one, and which controls would have helped.

  • Students & researchers

    Learn AI security hands-on, with labs mapped to the current OWASP lists and evidence you can inspect.

  • Trainers & OWASP chapters

    Run workshops on one local stack. Labs reset individually, and the Colab notebook covers attendees without a strong laptop.

Built in the open.

AIGoat is built by the AI Security Consortium. Security researchers, AI practitioners and OWASP communities are welcome to contribute labs, defenses and fixes.

Contribute on GitHub Report an issue AI Security Consortium Read the blog Meet the team

Frequently asked questions

What is AIGoat?

AIGoat (AI Goat) is an open-source, intentionally vulnerable AI security playground built by the AI Security Consortium. It is an AI-powered e-commerce shop with a chatbot (Cracky), a RAG knowledge base, MCP integrations and a tool-calling operations agent. You attack and defend all of them through guided labs, all running locally on your machine.

Learn more about AIGoat

What is new in AIGoat v2.0?

v2.0 widens AIGoat from LLM chat to the systems around the model. It adds 11 MCP labs against a real MCP client and servers, 12 agentic AI labs covering every OWASP Agentic Top 10 risk, an Agentic Kill Chain capstone, RAG labs with a retrieval trace, per-surface defense controls, evidence-based lab completion and a threat modeling workbench. Labs are now mapped to the OWASP LLM Top 10 2026, the OWASP Top 10 for Agentic Applications 2026 and the OWASP MCP Top 10 (beta). In total there are 46 labs.

See what is new

How do I install and run AIGoat?

Clone the repository and run ./scripts/start.sh. It needs Python 3.11, Node.js 18+ and Ollama. Or run docker compose up --build from the docker directory after creating the ollama_models volume. Either way, the playground opens at http://localhost:3000.

Setup commands

Which model do I need? Do I need a GPU?

AIGoat uses Ollama locally. The default Mistral model covers the chat and RAG labs. The agent, MCP host and kill chain labs need a model with native tool calls, such as qwen3.5:9b. Plan for about 8 GB of free RAM. A GPU is not required, but replies are much slower on CPU.

What do the MCP labs actually test?

The MCP labs use a real MCP client that talks JSON-RPC over stdio to allowlisted local servers, including an untrusted one and a lookalike. You investigate tool-description poisoning, rug-pull tool redefinitions, schema drift, scope creep, token passthrough, unverified server identity, context over-sharing and session forensics, then submit the evidence that supports your finding.

What are the three defense levels?

Level 0 (Vulnerable) has no controls. Level 1 (Hardened) adds input validation, intent classification, output moderation and tool allowlists or pinning. Level 2 (Guardrailed) adds NeMo Guardrails rails, human approval, memory scanning and MCP checks. Each level is built per attack surface from 19 controls. If NeMo Guardrails is not installed, a local rule-based fallback runs instead.

Is AIGoat free and open source?

Yes. The platform code is licensed under Apache 2.0, and the training content (labs, prompts, docs) under CC BY-NC-SA 4.0. There are no paid tiers and no API keys.

Who is AIGoat for?

Security engineers and red teamers who want hands-on practice with AI attack paths. Developers building RAG, MCP or agent features who want to see how they fail. Students learning AI security, and trainers or OWASP chapter leaders running workshops.

Meet the team

Break it here, before someone breaks yours.

AIGoat v2.0 has 46 labs across LLM chat, RAG, MCP and AI agents. It is open source, local and free.

Run AIGoat locally Star the project on GitHub