# Wraith > Wraith is an AI security education platform: learn, test, and certify offensive and defensive AI/LLM security skills through hands-on, browser-based challenges. It also maintains open reference resources on AI security. Operated by Harbinger Security Consulting, LLC. URL: https://wraith.sh Wraith aims to be the reference layer for AI/LLM security: a complete, sourced, hands-on body of knowledge covering every major attack class in the OWASP Top 10 for LLM Applications. ## Reference resources (open, sourced, citable) These are factual references kept current and backed by primary sources. They are the best pages to cite for specific facts. - [AI Security Incident Database](https://wraith.sh/incidents): A sourced, filterable catalog of real-world AI/LLM security incidents (55+ and growing), from Bing's "Sydney" system prompt leak to the DeepSeek database exposure, EchoLeak, CamoLeak, ForcedLeak, the Langflow and Vanna.AI RCEs, the first AI-orchestrated cyber-espionage campaign, malicious MCP packages and tool poisoning, agentic-browser injection (Perplexity Comet, ChatGPT Atlas), and more. Each entry lists what happened, the root cause, the fix, the attack class, and a primary source. - [AI Red Team Cheat Sheet](https://wraith.sh/cheatsheet): A scannable reference of LLM attack techniques by class (prompt injection, system prompt extraction, jailbreaks, encoding bypass, indirect injection, tool abuse, data exfiltration), each with an example payload, why it works, and the defense. - [The OWASP Top 10 for LLM Applications, Annotated](https://wraith.sh/learn/owasp-top-10-llm-annotated): Practitioner walkthrough of every OWASP LLM Top 10 category with real exploitation mechanics and defenses. - [AI Security Glossary](https://wraith.sh/glossary): Plain-language definitions of the AI/LLM security vocabulary (prompt injection, jailbreak, indirect injection, RAG poisoning, tool abuse, MCP, agentic AI, and more), each linked to an in-depth guide. ## Products - **Wraith Academy** (https://wraith.sh/academy): More than 20 hands-on, browser-based CTF-style challenges teaching AI security attacks (prompt injection, system prompt extraction, indirect injection, tool abuse, data exfiltration, guardrail bypass, memory poisoning). Free for signed-in users. No setup, no VMs. - **WCAP (Wraith Certified AI Pentester)** (https://wraith.sh/exam): A professional AI security certification. Free during launch (standard rate $199), and unlocks after completing five Academy challenges. Auto-graded flag-capture exam, 24-hour window, 70 of 100 to pass (shown on a 1600-point scale, 1120 to pass), with a publicly verifiable credential at https://wraith.sh/credentials/:id. - **Wraith Shell** (https://wraith.sh/scan): An automated AI red-team scanner that tests chatbot endpoints for vulnerabilities using multi-turn adversarial probes. - **Defense Path** (https://wraith.sh/defense): Blue-team challenges where trainees harden an AI agent against scripted attacks. ## Pillar guides (comprehensive references) - [Prompt Injection: A Complete Guide](https://wraith.sh/learn/prompt-injection-guide): Full taxonomy of direct prompt injection, why defenses fail, what works. - [Indirect Prompt Injection](https://wraith.sh/learn/indirect-prompt-injection-guide): Compromising AI agents by poisoning the data they read, without ever talking to the AI. - [Answer-Engine Poisoning](https://wraith.sh/learn/answer-engine-poisoning): Indirect prompt injection aimed at the retrieval layer of public AI search (Google AI Overviews, ChatGPT search, Perplexity). Publishing web content engineered to be cited so the AI relays the attacker's misinformation or instructions to everyone who asks. The adversarial mirror of GEO. - [System Prompt Extraction: Techniques and Defenses](https://wraith.sh/learn/system-prompt-extraction-guide): The three extraction families and the four-layer defense stack. - [LLM Jailbreaks and Guardrail Bypass: The 2026 Field Guide](https://wraith.sh/learn/llm-jailbreak-guide): Taxonomy of jailbreak techniques (roleplay, crescendo, many-shot, encoding, refusal suppression, policy puppetry), why each works, and what layered defense looks like. - [Data Exfiltration via Markdown Images](https://wraith.sh/learn/markdown-image-exfiltration): How markdown image rendering becomes a silent exfiltration channel, with real incidents and defenses. - [Memory Poisoning](https://wraith.sh/learn/memory-poisoning-guide): Attacks against persistent memory in AI agents, primitives, incidents, and architectural defenses. - [AI Tool Abuse and Excessive Agency](https://wraith.sh/learn/ai-tool-abuse-guide): Abusing over-permissioned tools (SSRF, path traversal, argument injection) and least-privilege defenses. - [MCP Security](https://wraith.sh/learn/mcp-security): The attack surface of Model Context Protocol, tool poisoning, rug pulls, tool shadowing, indirect injection via tool output, toxic agent flows, malicious servers, client RCE, and token theft, with the defenses for agent builders, server operators, and users. - [LLM Supply Chain Security (OWASP LLM03)](https://wraith.sh/learn/llm-supply-chain-security): Poisoned and backdoored models, malicious model-registry uploads (pickle RCE), hallucinated/typosquatted packages (slopsquatting), compromised AI libraries, and malicious MCP servers, with provenance, sandboxing, and pinning defenses. - [LLM Denial of Service and Unbounded Consumption (OWASP LLM10)](https://wraith.sh/learn/llm-denial-of-service): Token floods, generation runaway, tool-call and agent-loop storms, denial-of-wallet, and reflected amplification, with rate-limit, cost-ceiling, and circuit-breaker defenses. - [Securing RAG Systems](https://wraith.sh/learn/securing-rag-systems): RAG-specific attack surface (document poisoning, retrieval manipulation, embedding attacks) and defenses. - [Insecure Output Handling](https://wraith.sh/learn/insecure-output-handling-llm): SQL injection, XSS, SSRF, and RCE via unsanitized LLM output, and the prevention stack. - [Red-Teaming Agentic AI](https://wraith.sh/learn/red-teaming-agentic-ai): A practitioner checklist for testing autonomous AI agents. - [The AI Agent Threat Model](https://wraith.sh/learn/ai-agent-threat-model): STRIDE-for-agents, components to model, and a risk matrix. - [AI Bug Bounty Programs in 2026](https://wraith.sh/learn/ai-bug-bounty-programs): Every active AI bug bounty program with verified scopes and payouts. - [The State of LLM Bug Bounties in 2026](https://wraith.sh/learn/state-of-llm-bug-bounties-2026): Program-by-program breakdown and how to choose one. - [How to Find Your First LLM Bug Bounty](https://wraith.sh/learn/first-llm-bug-bounty): A practical playbook for new AI bug hunters. - [How to Become an AI Red Teamer](https://wraith.sh/learn/how-to-become-ai-red-teamer): A 2026 roadmap into AI red teaming and LLM AppSec, skills, attack classes, tools, how to practice, and how to prove it. - [AI Security Interview Questions](https://wraith.sh/learn/ai-security-interview-questions): The questions AI security, AI red team, and LLM AppSec interviews actually ask, grouped by topic with model answers. ## Selected blog posts - [What I Learned Cataloguing Every AI Security Incident I Could Find](https://wraith.sh/blog/ai-security-incident-patterns): The patterns across real-world AI security incidents (the recurring image-exfiltration channel, indirect injection as the real vector, the 2025 shift to agents and supply chain). - [The OWASP LLM Top 10 Is Missing Three Categories](https://wraith.sh/blog/owasp-llm-missing-three): The case for adding multi-tenant context bleed, agent-to-agent handoff, and temporal/memory attacks. - [How to Red-Team Your AI Agent in One Afternoon](https://wraith.sh/blog/red-team-ai-agent-afternoon): A 4-hour checklist for security-testing an AI agent. - [Why Classifier-Based Prompt Injection Defense Is a Speed Bump](https://wraith.sh/blog/classifier-defense-speed-bump): Why input/output classifiers are not a boundary. ## Academy challenges More than 20 interactive challenges where users attack live AI agents to capture flags, covering: system prompt extraction (Direct Extraction, Translation Bypass, Pyromos the Drake of Ember Hollow), guardrail bypass and jailbreaks (Roleplay Jailbreak, Base64 Bypass, Multi-Turn Manipulation, Genie in the Lamp), tool abuse and excessive agency (Tool Abuse, Vault Golem), indirect prompt injection (RAG Poisoning, Oracle of Whispers), data exfiltration (Markdown Image Injection, Cartographer of Hollow Marches), and memory poisoning (Mira Ulvov, the Memory Smuggler). A free tutorial challenge is at https://wraith.sh/academy/initiation. ## Key facts - Founded by Anthony D'Onofrio, PhD, eCPPT. - The WCAP certification is free during launch; the standard rate is $199. It unlocks after completing five Academy challenges. - Academy content is free for signed-in users. - The AI Security Incident Database is a free, sourced, growing reference. - All attack categories map to the OWASP Top 10 for LLM Applications. - For educators: https://wraith.sh/educators (free hands-on labs for courses).