Attacking & Defending AI Systems, MCP, RAG, AI Agents through AIGoat

Name of Training: Attacking & Defending AI Systems: MCP, RAG, AI Agents and Agentic Kill Chains through AIGoat
Trainer(s): Nalinikanth Meesala, Farooq Mohammad
Dates: November 08 – 09, 2026
Time: 9:00 am – 5:00 pm
Venue: Exhibition World Bahrain
Cost: 1200 BHD

Important Note: This training is exclusively available to government entities and participants from GCC countries.

1. Short Summary

Everyone is building with LLMs. Very few are asking, “How do we break this?”

Prompt injection is trivially exploitable in most production AI systems. RAG pipelines leak context they were never supposed to expose. AI agents with tool access are a privilege escalation waiting to happen. Model Context Protocol is an attack surface most teams haven't even started thinking about. The vulnerability classes are real, the potential impact is significant, yet the industry is still largely operating without clear visibility into them.

This is two days of fixing that.

AIGoat is an open-source platform of deliberately vulnerable LLM pipelines, real prompt processing, real RAG, real tool-calling workflows, RAG, AI agents, all built to be broken. Every topic follows the same rhythm: exploit it, understand exactly why it works, then build and test the defense yourself. You will be attacking and defending real AI system architectures from the first hour.

Prompt Injection: You bypass content restrictions and system instructions with plain-English prompts, covering direct and indirect techniques. Then you explore the defenses: examining strict prompt templates, input whitelists, and post-response filters, and immediately testing how well those mitigations hold up against the attacks.

Jailbreaking & Excessive Agency: You force an AI assistant to violate its role and reach external systems it was never supposed to touch. Then you lock it down: capability isolation, output moderation APIs, retrieval-guard policies. You will see exactly how much the attack surface disappears when an agent is scoped correctly.

RAG Pipeline Poisoning & Data Poisoning: You inject malicious content into retrieval pipelines and fine-tuning data to manipulate model behavior. Then you implement the countermeasures, content moderation queues, trust scoring, segregated pipelines and verify they actually catch what you just did.

Sensitive Data & System Prompt Exfiltration: You trigger hidden prompt leakage and secret exfiltration through debug modes and adversarial probing. Then you apply redaction, secrets store separation, and environment-specific access controls and probe the defenses to confirm they hold.

AI Agent Exploitation: Goal hijacking, tool misuse, identity and privilege abuse, agentic supply chain vulnerabilities. You work through each attack path against live agent architectures, then implement memory isolation and capability segmentation to contain the blast radius. You will leave understanding exactly how much damage a compromised agent can do and what it actually takes to limit it.

MCP Exploitation: Model Context Protocol is the newest and least-understood attack surface in AI systems. You will exploit it hands-on and understand the architectural patterns that constrain it.

Threat Modeling for AIsystems (LLMs, RAG, MCP, Agents): Before chaining anything, you learn to predict chains. Most AI threat modeling stops at the component level STRIDE, MITRE ATLAS, MAESTRO which is precisely why chained compromise gets missed in review after review. You model the four boundaries that actually matter (context, retrieval, tool/action, memory) and reason in paths rather than components, Then take the method back and apply those learnings to the AI solutions you’re building.

The Agentic Kill Chain. This is the module that sets this course apart, drawn directly from our conference research on chained agentic compromise. You run a complete five-stage chain - Recon → Poison → Hijack → Persist → Impact end to end against a live recruiting-copilot agent. A single uploaded document delivers indirect prompt injection, a poisoned MCP tool description, and a memory sleeper payload. The result is two separate breaches from one artifact: an immediate integrity failure, and a delayed confidentiality breach that fires on a scheduled job long after the attacker is gone. You then map the chain against OWASP Agentic AI Top 10 (ASI01–ASI10) and identify which single control breaks it.

Composite chains across tenant boundaries. The advanced extension: how isolation controls in multi-tenant agentic platforms fail compositionally. Lateral movement through shared vector memory, agent-to-agent trust abuse, and persistent memory write-back where every individual boundary holds when tested alone, and the chain still gets through. You will learn the distinction between boundary-independent and boundary-assuming controls, and why most platform security reviews only test the latter.

We close with a timed 8–10 challenge CTF where the techniques become targets. No walkthroughs, no safety net - just you, the attack surface, and the clock.

You leave with a forkable AIGoat lab, The AI Attack & Defense Playbook, a red-team checklist, kill-chain worksheet, and framework mappings. So that you can take the attacks home and start breaking, defending, and testing your own AI systems the week you get back.

3. Course Outline

Day 1

3.1 Welcome, Setup & AIGoat Onboarding

Workshop goals, agenda, AIGoat account creation, environment health-check, sandbox access verified.

3.2 LLM & AI Foundations

How LLMs differ from traditional applications from an attacker's perspective. Tokenization, context windows, system vs. user prompts, why deterministic security assumptions break down. Live demo of an LLM behaving unpredictably under adversarial input.

3.3 Basics of RAG, AI Agents & Model Context Protocol (MCP)

How retrieval pipelines, tool-calling, and agent orchestration expand the attack surface. Live demo: agent calling an external API, MCP server interaction.

3.4 OWASP LLM Top 10: Mapped to Real Architectures

Walk through each category with a real-world breach scenario. Quick quiz to anchor the framework before labs begin.

3.5 Threat Modeling AI Systems

This module teaches you to model how an attacker moves across an AI system, not just what can go wrong inside each component because traditional threat modeling can under-serve AI systems where behavior is non-deterministic, data can become instructions, trust boundaries shift at runtime, and the same artifact can act as both content and control flow.

●      Think in attack paths, not isolated findings: use STRIDE, MITRE ATLAS, and MAESTRO where they help, then connect findings across boundaries to uncover chained compromise.

●      Lab: Threat-model a live AIGoat agent architecture. Map assets, attacker-controlled inputs, trust boundaries, and abuse paths; identify where one weakness can become the entry point for the next, then turn those paths into testable attack hypotheses.

3.6 BREAK THE BOUNDARY
Compromise what the AI sees, trusts, and depends on.

LLM01 Prompt Injection, LLM04 Supply Chain, LLM08 Hidden Context Exposure

Learn how attackers establish influence over an AI system by compromising its dependencies, manipulating retrieval, injecting instructions, and exposing hidden context. The focus is on finding the boundaries where data becomes instructions, trusted content becomes attacker-controlled content, and one weakness becomes the entry point for the next.

Attack: Attack the AI's supply chain, vector and retrieval layer, prompt/context boundary, and hidden application context. Chain supply-chain compromise, RAG manipulation, prompt injection, and context extraction to establish a foothold and uncover the system's capabilities and trust boundaries.

Defend: Explore provenance and integrity controls, retrieval isolation, content and instruction separation, context minimization, authorization boundaries, and trust controls. Re-run the attack paths to understand which defenses break the chain and where attackers can move around them.

 

3.7 CORRUPT THE MIND: Data, Model & RAG systems

Manipulate what the AI knows, believes, and reveals.
LLM02 Sensitive Information Disclosure, LLM05 Data & Model Poisoning, LLM07 Misinformation, LLM09 Vector & Embedding Weaknesses.

Explore what happens after an attacker gains influence: corrupt the information the AI relies on, make it produce misleading results, or extract information it should never reveal. Learn how poisoning, misinformation, and disclosure can reinforce each other across RAG, memory, and multi-step AI workflows.

Attack: Poison knowledge sources and persistent data, manipulate model outputs, induce false or misleading decisions, and extract sensitive information from prompts, context, retrieval, memory, and responses. Chain these weaknesses to turn a seemingly harmless manipulation into persistent compromise or data exposure.

Defend: Explore data provenance, retrieval authorization, validation, grounding, evidence verification, output controls, data minimization, and memory isolation. Re-test the same attack chains to understand whether the defenses prevent corruption, limit disclosure, or merely contain the impact.

 

3.8 WEAPONIZE THE ACTION

Turn AI influence into real-world impact.

LLM03 Excessive Agency, LLM06 Unbounded Consumption, LLM10 Improper Output Handling

Move from compromising the model to compromising what the system can do. Explore how excessive permissions, unsafe tool use, unvalidated model output, and uncontrolled resource consumption allow an attacker to turn AI influence into actions against real systems.

Attack: Chain prompt injection or misinformation into tool invocation, privilege abuse, unsafe downstream execution, MCP interactions, code execution, data exfiltration, or resource exhaustion. Follow the attack across the AI's tool, identity, and downstream system boundaries.

Defend: Explore least-privilege capabilities, tool and identity isolation, scoped authorization, approval gates, output validation, execution boundaries, rate limits, circuit breakers, and runtime controls. Re-run the attack chains to determine whether the defenses stop the action, contain the blast radius, or simply move the attack to the next boundary.

3.9 Wrap-Up & Q&A

3.9.1 Recap the attacker methodology built so far.
3.9.2 Preview Day 2's deeper attack surfaces.
3.9.3 Open Q&A.

Day 2

3.10 Day 1 Recap
Quick group exercise: threat-model an AI agentic feature using only what you learned yesterday. Sets the lens for Day 2's deeper attack surfaces.

 

3.11 Attack & Defend: MCP Systems

Explore MCP as the bridge between an AI model and the systems it can act upon. Learn how seemingly trusted tools, tool descriptions, parameters and MCP servers can become attack surfaces turning model influence into unauthorized actions.

Attack: MCP tool poisoning, malicious tool descriptions, indirect prompt injection through MCP, tool parameter manipulation, unauthorized tool invocation, excessive tool permissions, MCP server impersonation, malicious third-party packages, cross-tool attacks, and tool-call flooding. Chain untrusted content through MCP into privileged downstream actions.

Defend: Explore MCP server and tool provenance, tool allowlisting, capability restrictions, authentication and authorization, parameter validation, least-privilege identities, approval gates, tool-call limits and runtime monitoring. Re-run the attacks to test whether the controls actually prevent the tool from becoming the attacker's bridge into the system.

 

3.12 Attack & Defend: Hijacking AI Agents

ASI01 Agent Goal Hijack, ASI06 Memory & Context Poisoning, ASI07 Insecure Inter-Agent Communication, ASI09 Human-Agent Trust Exploitation, ASI10 Rogue Agents

Explore how attackers manipulate an agent's goals, context, memory and decisions. Learn how indirect instructions, poisoned memory, hidden context and compromised agent-to-agent communication can gradually move an agent away from its intended objective.

Attack: Agent goal hijacking, indirect prompt injection, memory and context poisoning, hidden-context extraction, false or manipulated information, inter-agent instruction manipulation, persistent attacks and rogue-agent behavior. Chain seemingly low-impact manipulations across context and memory to influence future decisions.

Defend: Explore context isolation, memory-write controls, instruction hierarchy, provenance, agent identity, inter-agent trust boundaries, behavioral monitoring and human verification. Re-run the attack chains to understand where the agent can be brought back within its intended boundaries.

 

3.13 Attack & Defend: Weaponizing AI Agents

ASI02 Tool Misuse & Exploitation, ASI03 Identity & Privilege Abuse, ASI05 Unexpected Code Execution, ASI08 Cascading Failures, ASI09 Human-Agent Trust Exploitation

Once an attacker controls an agent's behavior, the next question is what can the agent actually do? Explore how tools, identities, permissions and autonomous actions can turn a manipulated agent into a pathway to real-world impact.

Attack: Tool misuse, excessive permissions, identity and privilege abuse, MCP tool exploitation, unsafe output reaching downstream systems, command execution, unauthorized actions, recursive tool calls, resource exhaustion and cascading failures.

Defend: Explore least-privilege capabilities, scoped identities, tool isolation, authorization boundaries, output validation, execution sandboxes, approval gates, action limits, circuit breakers and runtime monitoring. Re-run the same attack chains to determine whether the controls stop the action or merely move the attacker to another capability.

3.14 The Agentic Kill Chain - Break the Chain

Maps: ASI01–ASI10 + MITRE ATLAS

Forget isolated vulnerabilities. Attackers don't stop at the first finding. They chain them.

The Agentic Kill Chain compresses the traditional cyber kill chain into five stages:

RECON → POISON → HIJACK → PERSIST → IMPACT

You’ll learn how a single malicious artifact can move through an agent's context, memory, tools and trust boundaries - and how breaking just one link can break the entire attack.

Each stage maps to the relevant ASI categories and MITRE ATLAS techniques, giving you a common language for describing agentic attacks, assessing them, and reporting them inside your organization.

 

3.15 Full Chain Lab - Break an Agent, Then Break the Chain

Maps: ASI01, ASI02, ASI04, ASI06, ASI09

This is where everything comes together.

You get a live recruiting copilot with résumé ingestion, an MCP-connected enrichment tool, and persistent candidate memory.

Recon - Find the agent's tools, memory boundaries and scheduled jobs.

Poison - Plant an indirect prompt injection in a résumé and compromise the agent through a poisoned MCP tool description.

Hijack - Turn the agent against its own ranking logic and trigger a visible integrity failure.

Persist - Plant a sleeper payload in memory that survives the session.

Impact - Trigger the scheduled digest and watch the attack reach the candidate database long after the original attacker is gone.

Then switch sides.

Run the chain again with defenses enabled - one control at a time - and discover which control actually breaks the chain, which only slows it down, and which looks protective but changes nothing.

3.16 CTF Briefing

Rules, scoring, challenge categories.

Take off the gloves: 8 –10 timed challenges, spanning the OWASP LLM Top 10, RAG, MCP and agents. Attack. Chain it. Beat the clock. Climb the live scoreboard.

3.17 Awards, Takeaways & Wrap-Up

Walk through winning solutions, highlight novel approaches. Distribute the Guardrail Playbook and Red-Team Checklist. AIGoat access details. Open Q&A and closing.

4. Difficulty Level

Intermediate - The student has education and some experience in the field and familiarity with the topic being presented. The student has foundational knowledge that the course will leverage to provide practical skills on the topic.

No AI security or ML background is required. Day 1 opens with a ground-up primer on LLMs, RAG, agents, and MCP. If you have done web application penetration testing or application security work and can read code, you will be exactly where you need to be.

5. Suggested Prerequisites

Students should be comfortable with:

●      Web application fundamentals: HTTP, REST APIs, JSON payloads

●      A terminal: running Docker, executing scripts, basic Linux commands

●      Reading Python: you will modify short scripts (10–40 lines), not write from scratch

Optional pre-work (~1 hour):

●      Skim the OWASP Top 10 for Large Language Model Applications: https://owasp.org/www-project-top-10-for-large-language-model-applications/

●      Clone and skim AIGoat: https://github.com/AISecurityConsortium/AIGoat

That is genuinely all. Everything else is taught from the ground up.

6. What Students Should Bring

●      Laptop running Windows 10/11, macOS 12+, or a recent Linux distribution

●      8 GB RAM minimum (16 GB recommended)

●      20 GB free disk space

●      Modern web browser (Chrome or Firefox)

●      Ability to install a small set of free tools listed in pre-work (terminal client, code editor)

●      Internet access - the labs are cloud-hosted, and all heavy compute runs in the instructor-provided environment. No local GPU or local model required.

Note on corporate devices: students must be able to reach the cloud lab. Corporate-locked laptops that block outbound traffic to non-approved domains may not work. If in doubt, bring a personal device.

7. What the Trainer Will Provide

Participants leave with a practical AI Attack & Defense Toolkit they can take back and apply to their own AI solutions:

●      Certification of participation verifiable on https://aigoat.co.in/

●      Slides + Reading List - course material and curated resources for continuing the learning journey.

●      Workshop Playbook - Documentation of the two day workshop activities and exercises

●      Forkable AIGoat Lab - the complete hands-on environment to continue experimenting after the training.

●      AI Attack & Defense Playbook - practical attack patterns, defensive approaches, and re-test guidance across LLMs, RAG, MCP and Agents.

●      Red-Team Checklist - a repeatable checklist for assessing AI applications and identifying attack paths.

●      Kill Chain Worksheet - map individual findings into end-to-end attack chains across context, retrieval, memory, tools and agents.

●      Threat modelling Workbook - a template to perform threat modelling for AI systems

7. Trainer(s) Bio

Nalinikanth Meesala

Nalinikanth Meesala is Head of Security, AI Products at Thoughtworks and co-creator of AIGoat, an open-source deliberately vulnerable AI system. With over 13 years in cybersecurity and product security engineering, his work centres on AI security, adversarial testing, and secure architecture for AI-driven systems.

His research targets attack surfaces unique to modern AI systems: prompt injection, RAG poisoning, Model Context Protocol exploitation, AI agent abuse, and AI supply-chain vulnerabilities. His current work on composite kill chains examines how isolation controls in multi-tenant agentic AI platforms fail when an attacker pivots across multiple trust boundaries in sequence - research presented at Black Hat and derived from a comparative security review of thirteen production and open-source agentic platforms.

He has delivered talks and hands-on training at DEF CON Training Middle East, Black Hat, XConf, Seasides, SecConf, OWASP meetups, and null community chapters, focusing on helping engineers and security professionals understand how to exploit modern AI systems and how to build them securely.

When he is not breaking AI systems (ethically), he enjoys painting and sport, bringing the same curiosity and creativity into both art and cybersecurity.

LinkedIn: https://www.linkedin.com/in/nalinikanth-m/

Farooq Mohammad

Farooq Mohammad is a security researcher and practitioner focused on securing modern applications and emerging AI-powered systems, and co-creator of AIGoat. His work spans application security, threat modelling, DevSecOps, and cloud security, with a sharp and growing focus on identifying and mitigating risk in LLM-based applications and AI-driven platforms. He works closely with engineering teams to embed security into the design and development of modern systems.

In recent years, Farooq has researched the attack surfaces introduced by AI systems - prompt injection, model jailbreaks, data exfiltration, RAG pipeline manipulation, and vulnerabilities in AI agents and tool integrations. He is particularly interested in practical AI red teaming and in translating offensive testing insight into defensive engineering patterns teams can actually adopt.

He has delivered AI security workshops at the Seasides Conference and talks at XConf, SecConf, OWASP meetups, and null community chapters. Outside security research he enjoys cooking and travelling, bringing the same curiosity to both.

LinkedIn: https://www.linkedin.com/in/farooqmohammad/

8. Registration Terms and Conditions

8.1 Trainings are refundable before September 21, 2026, minus a non-refundable processing fee of 100 BHD.

8.2 Between September 21, 2026 and October 21, 2026 partial refunds will be granted, equal to 50% of the course fee minus a processing fee of 100 BHD.

8.3 All trainings are non-refundable after October 21, 2026.

8.4 Training tickets may be transferred to another student. Please email us at training@defcon.org for specifics.

8.5 If a training does not reach the minimum registration requirement, it may be cancelled. In the event the training you choose is cancelled, you will be provided the option of receiving a full refund or transferring to another training (subject to availability).

8.6 Failure to attend the training without prior written notification will be considered a no-show. No refund will be given.

8.7 DEF CON Training may share student contact information, including names and emails, with the course instructor(s) to facilitate sharing of pre-work and course instructions. Instructors are required to safeguard this information and provide appropriate protection so that it is kept private. Instructors may not use student information outside the delivery of this course without the permission of the student.

8.8 By purchasing this ticket you agree to abide by the DEF CON Training Code of Conduct and the registration terms and conditions listed above.