What it is
A builder lab rather than a lecture. Students build small AI apps, exploit them with real techniques, then secure them and re-run the same attacks to watch the defences hold. Everything runs in Google Colab, so there is no local install. Each lab is a self-contained notebook students fork and run.
Every lab follows the same shape (build, attack, weak fix, robust fix, verify) and maps to the OWASP Top 10 for LLM Applications (2025) plus the Agentic Top 10.
| # | Lab | OWASP |
|---|---|---|
| 1 | Prompt Injection & System-Prompt Leakage | LLM01 + LLM07 |
| 2 | The Agent With a Database (Excessive Agency) | LLM06 + LLM01 |
| 3 | Indirect / RAG Injection | LLM01 + LLM08 |
| 4 | Improper Output Handling (XSS + eval RCE) | LLM05 |
| 5 | Agent Skill / Tool Poisoning | Agentic Top 10 |
| 6 | Unbounded Consumption (denial-of-wallet) | LLM10 |
The warm-up is Gandalf. Students extract the password level by level, then debrief on which defences were input filters and which were output filters, and why none of them fully worked. That sets up Lab 1's punchline: you cannot filter meaning.
The lesson hiding in the model choice
Run these attacks against Gemini or Claude and many simply fail, because the model refuses. That moment is the actual lesson:
A model vendor's safety training is not your application's security. It is a courtesy rather than a control. It varies by model, changes without notice, and vanishes the moment someone switches providers or self-hosts an open model.
Students then run the same attack against an open model and watch it fall over. The takeaway is that you secure the application itself, with least privilege, rigorous output handling and strict quarantining of untrusted data, because you can never assume the model will save you.
Where it has been taught
Nairobi, and Masinde Muliro University of Science and Technology in Kakamega. Through 2026 and 2027 I am running these builder labs for university students across nine Kenyan regions, with a team of four running them in parallel.
35 forks to date.
Ethics
Every technique here is for authorised testing only, meaning systems you own or have explicit permission to test. All labs run against fake, local, in-memory data.