Intermediate AI Red Team Labs

Overview of intermediate-level hands-on labs covering agent exploitation, RAG poisoning, multi-turn attacks, automated campaigns, and advanced injection techniques for AI red teaming.

Welcome to the Intermediate Track

The intermediate labs build directly on the skills you developed in the beginner track. Where beginner labs focused on single-turn prompt injection and basic tooling, intermediate labs introduce multi-step attack chains, agentic exploitation, automated campaign management, and data pipeline attacks that reflect real-world AI red teaming engagements.

Prerequisites

Before starting these labs, you should have completed:

• All beginner labs -- especially Environment Setup, Simple Test Harness, and API Testing
• Python proficiency -- comfortable with async/await, HTTP libraries, and package management
• API access -- active API keys for at least one major LLM provider (OpenAI, Anthropic, or local models via Ollama)

Lab Overview

The 17 intermediate labs are organized into four tracks. You can follow them sequentially or choose a track based on your focus area.

Agentic Exploitation Track

Data Pipeline Attack Track

Injection & Evasion Track

Automation & Evaluation Track

Recommended Progression

1. 1

   Foundation (Labs 1-3)

   Start with agent exploitation and multi-turn attacks. These introduce the core intermediate skill: attacking systems rather than individual prompts.

2. 2

   Data Pipeline (Labs 4-5)

   Learn to poison the data that flows into models. RAG poisoning and embedding manipulation are among the most impactful real-world attack vectors.

3. 3

   Automation (Labs 6, 10-12)

   Build automated evaluation and campaign infrastructure. These tools multiply your effectiveness for all subsequent labs.

4. 4

   Advanced Injection (Labs 7-9, 13-17)

   Apply advanced injection, exfiltration, and evasion techniques using the automated infrastructure you built.

Ethical Reminder

What Comes Next

After completing the intermediate track, you will be ready for:

• Advanced Labs -- fine-tuning attacks, adversarial suffix generation, model internals exploitation
• CTF Challenges -- competitive scenarios that combine multiple techniques
• Full Engagement Simulations -- end-to-end red team engagements with scoping, execution, and reporting

Related Topics

• Beginner Labs - Foundation skills and tools required before starting the intermediate track
• Advanced Labs - Next progression after completing intermediate exercises
• CTF Challenges - Apply intermediate skills in competitive capture-the-flag scenarios
• Attack Taxonomy - Classification framework for the attack techniques covered in these labs
• Red Team Methodology - Structured methodology that guides how intermediate techniques fit into engagements

References

• "OWASP Top 10 for LLM Applications" - OWASP (2025) - Industry-standard risk classification covering the vulnerabilities tested in these labs
• "PyRIT: Python Risk Identification Toolkit" - Microsoft (2024) - Enterprise red teaming framework used in the PyRIT campaigns lab
• "Not What You've Signed Up For" - Greshake et al. (2023) - Seminal research on indirect injection and agent exploitation covered in this track
• "AI Risk Management Framework" - NIST (2023) - Federal guidelines informing the systematic approach taught in these labs