Introducing AIGoat 2.0: Hands-On Security Labs for LLMs, RAG, MCP, and AI Agents
AI security is evolving rapidly. As applications move beyond standalone Large Language Models (LLMs) to Retrieval-Augmented Generation (RAG), connected tools, and autonomous AI agents, the attack surface is expanding.
AI security is evolving rapidly.
As applications move beyond standalone Large Language Models (LLMs) to Retrieval-Augmented Generation (RAG), connected tools, and autonomous AI agents, the attack surface is expanding.
Prompt injection is only one part of the problem. Tool misuse, excessive agency, untrusted context, and unintended actions introduce new challenges for security engineers and developers.
Understanding these risks requires more than reading about vulnerabilities. We need environments where we can reproduce attacks, investigate their impact, and experiment with defenses.
That is the motivation behind AI Goat 2.0.
Weβre excited to introduce the latest evolution of AI Goat, an open-source, hands-on AI security playground designed to help practitioners explore how AI systems can be attacked and defended.
What's New in AI Goat 2.0?
1. MCP Security Labs
The Model Context Protocol (MCP) enables AI applications to interact with external tools and systems. However, these integrations introduce new trust boundaries and security considerations.
AI Goat includes hands-on MCP security labs that help practitioners investigate risks associated with tool interactions, untrusted inputs, and the capabilities exposed to AI systems.
2. Agentic AI Security
AI agents can do more than generate text. They can select tools, interact with application functionality, maintain context, and perform multi-step tasks.
This creates a different security challenge: an attacker may manipulate an agent's behavior rather than simply influence its final response.
AI Goat's agentic security labs provide practical scenarios for exploring these risks and understanding their implications.
3. Agentic Kill Chain Challenge
One of the highlights is the Agentic Kill Chain challenge.
The scenario explores how malicious instructions embedded in seemingly legitimate content can influence an AI agent and potentially lead to unintended actions.
Instead of treating every vulnerability as an isolated issue, the challenge encourages practitioners to investigate how weaknesses can combine across an agent's context, tools, memory, and actions.
This is particularly relevant when evaluating AI assistants connected to business applications, where an apparently harmless interaction can have consequences beyond the model's response.
4. Hands-On Attack-and-Defend Learning
Identifying an attack is only half the work. Security practitioners also need to understand how to reduce its impact.
AI Goat brings attack and defense concepts into a practical learning environment, helping users investigate vulnerabilities, examine evidence, and understand the role of defensive controls.
The objective is to connect offensive testing with actionable defensive thinking.
5. An Expanded AI Security Learning Playground
AI Goat brings together multiple areas of AI application security, including:
- LLM security and prompt injection
- Retrieval-Augmented Generation (RAG) security
- Model Context Protocol (MCP) security
- Agentic AI security
- Practical attack scenarios and defensive concepts
The goal is to provide a unified environment where developers, application security engineers, penetration testers, AI red teamers, and security researchers can build practical skills.
Why Hands-On AI Security Matters
Consider an AI-powered e-commerce assistant that can search products, retrieve information from documents, access customer context, and interact with business tools.
What happens if an attacker places malicious instructions inside a document the assistant retrieves?
What if those instructions influence tool selection? What if the agent has more permissions than the task requires? What if malicious state persists beyond the original interaction?
These are not merely prompt-engineering questions. They are system security questions involving trust boundaries, authorization, excessive agency, data isolation, and monitoring.
Testing these scenarios in a controlled environment helps security teams reason about the complete attack path instead of focusing exclusively on the model.
That is the kind of practical learning AI Goat aims to support.
Who Is AI Goat For?
AI Goat is intended for people who want to understand AI security through experimentation, including:
- Application Security Engineers exploring AI-specific attack surfaces.
- Penetration Testers and Red Teamers investigating LLMs, RAG pipelines, MCP integrations, and AI agents.
- AI Engineers and Developers building more secure AI-powered applications.
- Security Researchers and Students learning about emerging AI threats through hands-on exercises.
Explore AI Goat 2.0
AI Goat is an open-source project, and we welcome practitioners who want to explore the labs, share feedback, report issues, and contribute to improving the learning experience.
- π» GitHub Repository: https://github.com/AISecurityConsortium/AIGoat
- π Project Website: https://aigoat.co.in/
- π Announcement: https://aigoat.co.in/blog/announcing-ai-goat-v2/
- π¨ LinkedIn Announcement: https://lnkd.in/p/d-RSTBNR
If you are working on LLM security, AI red teaming, MCP, RAG, or agentic systems, give AI Goat a try.
Explore the attack paths. Understand the failure modes. Experiment with defenses.
Our goal is simple: make AI security practical, hands-on, and accessible to the security community.
AISecurity #LLMSecurity #AgenticAI #MCP #CyberSecurity #AIGoat #RAG #AIKillChain #AgenticKillChain #KillChain
Originally published by Dev.to Security. Aggregated on AIWithGhost for educational purposes β full credit and traffic to the original publisher.