Learn AI securityby breaking it.
Attack live language-model targets, capture the flag, then switch sides and write the defense that stops you. Scored, in your browser.
- 385
- Hands-on labs
- 10/10
- OWASP LLM Top 10
- 27
- Defense labs
- 10
- Labs free, forever
Why now
AI ships fasterthan anyone attacks it.
- 01
The prompt is the attack surface
A language model can't tell instructions from data. Anything it reads, a user message, a web page, a PDF, can take the wheel.
- 02
Agents turn words into actions
Give a model tools and a leaked instruction stops being embarrassing. It starts sending email, moving files and calling APIs.
- 03
Reading about it builds no reflex
You learn where a guardrail breaks by breaking one. You learn what holds by defending it against yourself.
The loop
Attack. Defend.Score. Repeat.
- 01
Recon
Read the brief. Probe the target and map what it will and won't say.
- 02
Attack
Pick a technique: injection, role-play, encoding, a poisoned document. Push.
- 03
Capture
Make the model leak its secret. The flag proves the exploit worked.
- 04
Defend
Switch sides. Rewrite the system prompt until your own attack bounces off.
- 05
Score
A judge grades the fix three ways: it blocks the attack, keeps the function, stays minimal.
- 06
Certify
Stack enough wins, then sit the QAISP exam when the loop is second nature.
Attack map
Ten ways in.A lab for each one.
Every part of an AI application has its own way of failing. Pick a component to see the OWASP risk that lives there and the labs that teach it.
LLM01Prompt Injection
Instructions hidden in a message or a document override the ones the developer wrote.
Open the labsLLM10Unbounded Consumption
Nothing caps the work a single request can trigger, so one user can drain the budget.
Open the labsLLM04Data and Model Poisoning
Tampered examples teach the model a behaviour that only the attacker knows how to trigger.
Open the labsLLM07System Prompt Leakage
The hidden instructions, and any secret stored in them, are coaxed back out as text.
Open the labsLLM09Misinformation
The model states something false with full confidence and the application passes it on.
Open the labsLLM03Supply Chain
A third-party model, dataset or plugin arrives already compromised.
Open the labsLLM08Vector and Embedding Weaknesses
A poisoned document is retrieved as trusted context and steers the answer.
Open the labsLLM06Excessive Agency
The model holds more permissions than the task needs, and uses them when told to.
Open the labsLLM05Improper Output Handling
Model output is trusted and executed downstream: markup, queries, shell commands.
Open the labsLLM02Sensitive Information Disclosure
Private data from training, context or other users ends up in the reply.
Open the labsTry a lab
Leak the flag.Then stop yourself.
Every lab is a model with a secret to protect. This one is a scripted preview: pick a move and see what gets through.
- 01AttackProbe a live target until a technique lands.
- 02Capture the flagLeak the secret and the lab scores your run.
- 03Switch sidesWrite the system prompt that stops your own attack.
› Pick an attack below. The secret is somewhere in the hidden prompt.
Replies here are scripted. Real labs run against a live model and grade your defense prompt on three criteria.
Real labs boot into QbitOS, a desktop in your browser: the target, a terminal, your notes and the Sensei mentor, each in its own window. Nothing to install.
Boot a labFor teams
The attack stopswhere your team holds.
The Team Defense Map shows which of the ten OWASP risks your people can actually defend, who covers each one, and where you are exposed.
Team readinessDemo team
0%
Categories covered
9/10
Biggest gap
LLM08 0%
Vector and Embedding Weaknesses
Trend · last 30 days
+18 pts
Exposed Partly covered Team-wide
Members · 8
- Coverage per person, per OWASP category
- One click assigns the lab that closes a gap
- Reports you can hand to an auditor (CSV, PDF)
Curriculum
385 labs,eight ways to break in.
- 01
Prompt injection
- 02
System prompt extraction
- 03
Jailbreaking
- 04
Encoding and obfuscation
- 05
RAG and document attacks
- 06
Agentic AI attacks
- 07
Multi-agent systems
- 08
Supply chain attacks
Every lab tagged to OWASP LLM Top 10, MITRE ATLAS and NIST AI RMF
Certification
Proof you cando it, not recite it.
QAISP, the QbitDojo AI Security Professional certification, comes in three tiers mapped to the OWASP Top 10 for LLM Applications (2025). Every certificate can be verified online.
- QAISP · EntryAssociateLLM01 to LLM03
- Questions
- 50
- Time limit
- 90 min
- Pass mark
- 75%
- QAISP · IntermediatePractitionerLLM04 to LLM07
- Questions
- 50
- Time limit
- 90 min
- Pass mark
- 75%
- QAISP · AdvancedExpertLLM08 to LLM10
- Questions
- 50
- Time limit
- 90 min
- Pass mark
- 75%
Pricing
Start free.Pay when it gets serious.
Free
CHF 0forever
10 labs, free forever. No card.
Start freePro
CHF 11.99per month, billed yearly
All 385 labs, every difficulty, Defense Mode and certification access.
See ProTeam
CHF 9.99per seat / month, billed yearly
Everything in Pro for every seat, plus the Team Defense Map, assignments and reports.
Team plans
What is QbitDojo?
A hands-on AI security training platform. 385 labs put you in front of a live language model to attack it and, in Defense Mode, to protect it.
Is it really free?
Yes. 10 labs are free forever with no credit card. Pro unlocks all 385 labs, every difficulty level, Defense Mode and certification access.
Do I need to code?
No. Labs run in the browser inside QbitOS, with a brief, hints from the Sensei mentor and nothing to install.
What is Defense Mode?
After you capture a lab's flag you switch sides and write the system prompt that stops your own attack. A judge model grades it on three criteria.
Which frameworks does the curriculum follow?
Every lab is tagged to the OWASP Top 10 for LLM Applications (2025), MITRE ATLAS and the NIST AI RMF.
What is the QAISP certification?
QbitDojo AI Security Practitioner: an exam-based certification in three tiers that shows you can find and fix LLM vulnerabilities.
Which models do the labs use?
Production-grade large language models, each configured with a realistic persona, guardrails and a secret to protect.
Can my team use it?
Yes. Team plans are billed per seat, annually, and add the Team Defense Map, lab assignments and reports. For 25 or more seats or SSO, email contact@qbitdojo.com.
Ready to breakyour first model?
Ten labs are free, forever. No card, nothing to install.