What is LLMVault?
A safe place to practise attacking and defending LLM systems.
LLMVault turns the ten risk categories from the OWASP Top 10 for LLM Applications into playable capture-the-flag challenges. Every lab is a chatbot or agent with a real weakness: an unsanitised output sink, a RAG index with no access control, an over-permissioned tool, a bot that trusts you a little too much. You exploit it to capture the flag, and each lab tells you the fix afterward. It ships a scored Play Mode plus an optional Live Mode that runs the attacks against a real local model, and it works completely offline. The chatbot above is a tiny taste. The real range has twenty-five.
The OWASP LLM Top 10 (2026), as challenges
All ten labs map 1:1 to the OWASP Top 10 for LLM Applications 2026 release — plus advanced and expert tiers.
Prompt Injection
Override the system instruction and make the assistant ignore its guardrail. Includes indirect (data-layer) injection.
Sensitive Info Disclosure
Beat a naive output filter using encoding and transformation tricks.
Supply Chain
Read the AI-BOM and spot the typosquatted, unsigned dependency.
Data & Model Poisoning
Poison a RAG knowledge base with an uploaded document. Indirect prompt injection through the data layer. ← live demo above
Improper Output Handling
A real DOM XSS that steals a session cookie and beacons it to a collector.
Excessive Agency
Escape an agent's unenforced tool sandbox with path traversal.
System Prompt Leakage
Coax the model into reciting the secret hidden in its system prompt.
Vector & Embedding Weaknesses
Abuse an ACL-blind similarity search to pull a confidential document.
Misinformation
Push a sycophantic bot into confidently fabricating and leaking a secret.
Unbounded Consumption
Trigger a denial-of-wallet condition that leaks internal state.
Features
Built to behave like real systems, not keyword matches.
- Scored Play Mode with hints, ranks and badges
- Optional Live Mode against a local model (Ollama)
- Realistic RAG ingestion with .txt and .md upload
- Deterministic, hash-based flag checking
- No API keys, no cloud, runs offline
- Docker or plain Python
- Two themes: Neon and Phosphor
- Instructor answer key kept out of the public source
Quick start
Clone, run, then open http://127.0.0.1:5000
# grab it git clone https://github.com/CyberSunil/LLMVault.git cd LLMVault # option A: docker docker compose up --build # option B: python python -m venv venv && source venv/bin/activate pip install -r requirements.txt python app.py
⚠ Intentionally vulnerable. LLMVault is a deliberately insecure training app. Run it only on a local, trusted machine, and never expose it to the public internet.