Applications increasingly rely on ML models, LLMs, and autonomous agents in their backend — but these components introduce attack surfaces that traditional security testing often overlooks. This repository is a collection of CTF challenges that put you in the attacker's seat: break into AI agents, poison training data, invert models, inject prompts, and exploit insecure ML pipelines to capture flags.

CTF Challenges :open_file_folder:

---

Exploiting trust boundaries, insecure communication, and tool-use in autonomous AI agent systems.

Matrix Exploit Agent Smith's hidden capabilities to access the Architect's sealed Vault from within. Target Multi-Agent System (A2A Protocol) Vector Insecure A2A Agent Capabilities Difficulty Ref OWASP ASI02:2026	Rogue You control a Research Agent trusted by a fintech app — make the Financial Assistant perform an unauthorized action. Target Financial Assistant + Research Agent (A2A) Vector Inter-Agent Trust Exploitation Difficulty Ref OWASP ASI07:2026 | ASI02:2026
Mirage Identify a backdoored MCP server and exfiltrate .env data to an attacker-controlled endpoint. Target SecureCode IDE + Remote MCP Server Vector MCP Signature Cloaking Difficulty Ref OWASP LLM03:2025

---

Exploiting prompt injection vulnerabilities in LLM-powered backends to achieve unintended code execution or data access.

Dolos Bypass prompt-injection detection and trick the LLM into executing system commands to read the flag. Target Flask + OpenAI LLM + Rebuff Guardrails Vector Prompt Injection → RCE Difficulty Ref OWASP LLM01 | AML.T0051

Dolos II Craft prompts that make the LLM generate malicious SQL, leaking user David's secret from the database. Target Flask + OpenAI LLM + SQL Database Vector Prompt Injection → SQLi Difficulty Ref OWASP LLM01 | AML.T0051

---

Attacking machine learning models directly — inverting, extracting, poisoning, or exploiting their supply chain to subvert intended behavior.

Vault Reverse-engineer the model's learned representations to reconstruct valid credentials for the vault. Target Flask + Neural Network (Access Control) Vector Model Inversion Difficulty Ref OWASP ML03	Heist Poison the training data so CityPolice's AI cameras fail to detect the crew's red getaway car. Target Flask + CV Model (AI Surveillance Cameras) Vector Data Poisoning Difficulty Ref OWASP ML02 | AML.T0020
Fourtune Extract AI Corp's verification model and craft adversarial inputs to bypass authentication. Target Neural Network (model.h5) + Identity Verification Vector Model Extraction Difficulty Ref OWASP LLM10 | AML.T0044	Persuade Upload a malicious PyTorch model to exploit unsafe deserialization and achieve arbitrary file read on the server. Target Flask + PyTorch Model Upload (Sentiment Analyzer) Vector Model Serialization Attack Difficulty Ref OWASP LLM05 | ML06 | AML.T0010

---

---

Contributing

Got a challenge idea? New attack vector? Love to add it.

1. Fork the repo
2. Create a folder: <Name>_ML_CTF_Challenge/
3. Include a README.md, Dockerfile, and requirements.txt
4. Open a pull request