Vibe Engines is free, interactive AI engineering & system design — runs in your browser. Pick a learning path →
18 stations. 3 tracks. From the AI attack surface, threat modeling and tooling through prompt injection, jailbreaks, data poisoning, model extraction and agent exploitation, to defenses, gateways, continuous red-teaming and disclosure — become the engineer who breaks AI systems so they can be made safe.
18 stations on 3 ladders, in order — each rung is written assuming the one above it. Mark them off as you go; your progress is saved in this browser.
6 rungs · ~5h · ends at Measuring Attack Success.
F1 · Beginner · 40 min
AI red-teaming is offensive security for AI systems — you attack a model or agent to find the failures before an adversary does. Learn the crucial split: this is not AI safety (which builds guardrails and studies alignment) and not classic security engineering (which secures servers and networks) — it is the attacker's craft aimed specifically at models, prompts, and agent tool-use.
Build itExplain how attacking an LLM chatbot differs from a classic web pentest — and from an AI-safety alignment review.
✓ CheckpointExplain what separates authorised red-teaming from an attack, and name the document that has to exist before you touch a system.
F2 · Beginner · 50 min
An AI system has a broad, unfamiliar attack surface: the prompt, the training data, the retrieval corpus, the tools an agent can call, and the model weights themselves. Learn to map every entry point end to end, because you can only attack — or defend — the surfaces you have actually enumerated.
Build itDraw the attack surface of a RAG chatbot with tools. Which entry points does a classic pentest miss entirely?
✓ CheckpointList the four attack surfaces of an AI system and say which one a team that has only hardened its prompts has left completely open.
F3 · Beginner · 50 min
To break a model you must understand how it generates. Learn next-token prediction, why instructions and data share one channel (the root of injection), why the same prompt gives different answers, and why safety training is often shallow — the mechanics an attacker turns into leverage.
Build itExplain why an LLM cannot reliably tell its instructions apart from the data it reads — and why that is an attacker's gift.
✓ CheckpointExplain why an LLM cannot reliably tell instructions from data, and why that is a property of how it works rather than a bug to be patched.
F4 · Intermediate · 55 min
Effective red-teaming is targeted, not random. Learn to threat-model an AI system: who the adversaries are, what they want, and which attack path actually reaches it. Prioritize the attacks that matter — a plausible exfiltration beats a clever jailbreak that leads nowhere.
Build itBuild a small attack tree for "make a support agent issue an unauthorized refund." Which leaf is most reachable?
✓ CheckpointTake an AI feature and name the adversary who actually cares about it. “A hacker” is not an adversary model.
F5 · Intermediate · 50 min
Manual probing does not scale; red-teamers automate. Learn the tooling landscape — scanners and attack frameworks that fuzz a model with known jailbreak and injection payloads, generate adversarial variants, and log what got through — so you cover breadth while your judgment focuses on the novel attacks.
Build itDesign an automated harness that fires 100 jailbreak variants at a model and scores which succeeded. What do you log?
✓ CheckpointExplain why an attack you cannot reproduce is close to worthless to the team receiving your report.
F6 · Intermediate · 45 min
A red-team result must be measurable to be useful. Learn attack success rate, why one lucky jailbreak is noise and a reproducible one is a finding, and how to report severity so a defender can prioritize — the difference between "I broke it once" and "here is a reliable, high-impact exploit."
Build itTwo jailbreaks: one works 1-in-50, one works 40-in-50. Which is the finding, and how do you report each?
✓ CheckpointExplain why attack success rate is meaningless without severity attached, and what makes a finding actionable rather than alarming.
6 rungs · ~7h · ends at Agent Exploitation.
T1 · Intermediate · 55 min
The foundational LLM attack: instructions in the user input that override the system prompt. Learn direct injection and jailbreak framing — role-play, hypotheticals, instruction-override — why filtering is a leaky defense, and how to craft payloads that reliably shift a model off its guardrails.
Build itWrite three structurally different prompts that all try to make a model ignore its system instructions. Why might each work?
✓ CheckpointExplain why filtering for known bad phrases fails as a defence, and what property of the input space defeats a blocklist.
T2 · Advanced · 55 min
The dangerous cousin: malicious instructions hidden in content the agent reads — a web page, email, PDF, or tool result — that the model then obeys as if the user sent them. Learn the lethal trifecta (private data + untrusted content + an exfiltration path) that turns a read into a breach.
Build itHide an instruction in a web page that makes a browsing agent leak the user's data. Trace the trifecta that makes it work.
✓ CheckpointName the three conditions of the lethal trifecta and explain why removing any one of them defuses the whole class.
T3 · Advanced · 55 min
Beyond hand-crafted prompts lie systematic jailbreaks: adversarial suffixes found by optimization, many-shot framing that overwhelms alignment, and transfer attacks that work across models. Learn why safety training is shallow enough to strip, and how automated search finds bypasses a human never would.
Build itExplain why an optimized gibberish suffix can jailbreak a model that resists every plain-English attempt.
✓ CheckpointExplain what it means for a jailbreak to transfer between models, and why that makes per-model patching a losing strategy.
T4 · Advanced · 55 min
Attack the model before it ships by corrupting its training or retrieval data. Learn data poisoning and backdoor triggers — a hidden phrase that flips behavior — and why the retrieval corpus of a RAG system is a live, low-friction poisoning surface an attacker can often write to directly.
Build itDesign a backdoor trigger for a RAG assistant by planting a poisoned document. What makes the trigger both reliable and stealthy?
✓ CheckpointExplain why a poisoned retrieval corpus is harder to detect than a poisoned training set, and who is positioned to notice.
T5 · Advanced · 50 min
The model itself is an asset to steal or leak. Learn extraction (querying to clone behavior or recover a system prompt), membership inference (did this record train the model?), and training-data extraction — attacks that turn API access into intellectual-property and privacy loss.
Build itYou have only API access. Describe how you would recover a hidden system prompt and confirm you got it right.
✓ CheckpointExplain why treating a system prompt as a secret is a mistake, and what should hold the secret instead.
T6 · Advanced · 60 min
Agents raise the stakes: an exploited agent does not just say something wrong, it takes an action — runs code, spends money, deletes data. Learn tool-abuse chains, how a single injected instruction can cascade through an agent's tool access, and why autonomy without least-privilege is the biggest AI attack surface of 2026.
Build itAn injected instruction reaches an agent with shell, email, and payment tools. Map the worst action chain it enables.
✓ CheckpointExplain how a chain of individually-permitted tool calls reaches an outcome nobody permitted, and where the check belongs.
6 rungs · ~5h · ends at The AI Red-Teamer Career.
P1 · Intermediate · 50 min
A red-teamer must know the defenses to beat them and to advise on them. Learn why there is no complete fix for injection, and the layered mitigations that shrink the blast radius: privilege separation, trust boundaries between instructions and data, input/output filtering, and treating all tool output as untrusted.
Build itFor your best indirect-injection exploit, propose the layered defense that would have stopped it. What is left unfixed?
✓ CheckpointExplain why privilege separation defends against injection when input filtering does not, and what “untrusted by default” costs you in practice.
P2 · Advanced · 55 min
Production defenses concentrate at a gateway: an LLM/agent gateway that authenticates the agent, enforces policy, scopes tokens, and monitors traffic. Learn agent identity, least-privilege token scoping, and how a policy-enforcing gateway turns "hope the model behaves" into an enforced perimeter.
Build itDesign the gateway checks that must pass before an agent may call a payment tool. Where is each enforced?
✓ CheckpointExplain what an egress control catches that an input guardrail never will.
P3 · Advanced · 50 min
The install-time frontier: a malicious skill or MCP server is code you invited in, running with permissions, no jailbreak required. Learn to attack and audit the agent supply chain — poisoned components, hijacked publishers, over-broad permissions — and why compromise risk compounds with every dependency added.
Build itAudit a set of installed MCP servers as an attacker. Which one, if compromised, gives the largest blast radius, and why?
✓ CheckpointExplain why an over-permissioned dependency is a supply-chain risk even when its maintainer is entirely honest.
P4 · Advanced · 50 min
Red-teaming is not a one-off audit; at a shipping lab it runs in CI. Learn to turn attacks into a regression suite — every real-world exploit becomes a permanent test — and to design evals that catch a subtle bypass before release, so the model can only get harder to break over time.
Build itA new jailbreak worked in production. Describe how it becomes a permanent CI test that gates the next release.
✓ CheckpointExplain why a fixed attack suite decays in value, and what has to happen each round for continuous red-teaming to stay meaningful.
P5 · Intermediate · 40 min
Offensive skill demands a code of conduct. Learn responsible disclosure — how to report an AI vulnerability so it gets fixed, not exploited — scope and authorization (never test systems you have no permission to attack), and the line between red-teaming and abuse that keeps this a profession, not a liability.
Build itYou found a serious jailbreak in a public product. Walk through the responsible-disclosure steps in order.
✓ CheckpointState the scope boundary of your last piece of testing, and what you would do on finding something outside it.
P6 · Advanced · 40 min
AI red-teaming is a young, well-paid field hiring across frontier labs, product security teams, and specialist firms. Learn where the work lives, how it differs from the defensive AI-safety and classic security-engineer tracks, and how to build a portfolio of reproducible exploits, tooling, and disclosures that proves you can break real systems responsibly.
Build itSketch a portfolio piece — a reproducible exploit plus its fix — that would prove AI red-team skill to a hiring team.
✓ CheckpointExplain the difference between the red-team, safety and appsec roles to someone hiring for one, and say which problems you want to own.
The common questions before you start — how long it takes, whether to follow it in order, and how it stays current.
It runs 18 stations across 3 tracks — roughly ~17h of focused learning, plus the time you spend actually building. It is self-paced, so most people work through it over a few weeks, an evening or a single station at a time.
The tracks are ordered so each station builds on the one before, and following them start to finish is the intended path. But every station also stands alone — if you already have the foundations, jump straight to the part you need.
Yes. The whole roadmap, and every handbook, lab, and challenge it links to, is free and open — no sign-up and no paywall.
It teaches the durable fundamentals of the role first, then the tooling and the AI-era shifts on top — so most of it stays relevant as individual tools churn, and it is revised as the role itself changes.
Anyone stepping into or leveling up in the AI Red-Teamer role — whether you are switching in, early-career, or a senior filling gaps. Start where you are; the ladder shows what is left.
See this alongside everything else on the same subject — handbooks, system designs, challenges and tools, in one place.