AIGoat (AI Goat): Open Source AI Security Playground for LLM, Agentic AI, and MCP Red Teaming

AIGoat (also written AI Goat) is an open source, deliberately vulnerable AI application for hands-on LLM red teaming, agentic AI security, and MCP security training. Security engineers, red teamers, students, and researchers attack a live large language model inside a realistic AI-powered e-commerce store: prompt injection, jailbreaks, system prompt leakage, RAG poisoning, supply chain backdoors, MCP tool poisoning, agent memory poisoning, and data exfiltration.

AIGoat maps every lab to the OWASP Top 10 for LLM Applications 2026, the OWASP Top 10 for Agentic Applications 2026, and the OWASP MCP Top 10 (2025, beta). It ships 46 hands-on labs, 9 AI security CTF challenges, an Agentic Kill Chain capstone, a threat modeling guide, and 3 progressive defense levels up to NVIDIA NeMo Guardrails. Everything runs locally with Ollama, free and with no API keys, or in Google Colab if you cannot run it locally.

This application is intentionally vulnerable. Run it only on your own machine or a private Colab session, for learning. Do not expose it to the internet.

What’s new in v2.0: agent and MCP attack surfaces, labs grow from 17 to 46, the Agentic Kill Chain workbench, Learn pages, Google Colab support, and a refreshed UI. See RELEASE_NOTES_v2.0.md.

---

What is AIGoat?

At the core is Cracky, an AI shopping assistant backed by a real LLM (Mistral by default, via Ollama) and connected to a product database, an order system, and a poisonable vector knowledge base. Around it sit a tool-using shop agent, a staff admin assistant that speaks the Model Context Protocol (MCP) to allow-listed servers, and the Agentic Kill Chain workbench. Every weakness is real and mapped to an OWASP risk.

You exploit each vulnerability yourself, then switch on defenses to see what still works. Every attack, defense, and flag runs on your own hardware.

AIGoat platform architecture: attack labs, defense pipeline, and challenge engine

Attack Labs page with guided exercises for each OWASP risk

---

Key Features

• 46 attack labs across three OWASP lists: 23 for the LLM Top 10 (2026), 12 for the Agentic Top 10 (2026), and 11 for the MCP Top 10 (2025, beta). Each lab targets one attack surface (chat, RAG, agent, MCP client, or MCP host).
• Agentic Kill Chain capstone: hide an instruction in a product review or a PDF invoice, watch it persist in two memory stores, and see the agent exfiltrate customer data or quote a $1 price on a routine request. Compare Vulnerable, Defended (human approval) and Guardrailed (approval plus rails) modes, and see a wrong approval fail to leak data.
• 9 CTF challenges with per-user flags (AIGOAT{...}) generated at runtime, worth 2,100 points.
• 3 defense levels on every surface: from fully vulnerable, to input validation, intent classification, output filtering, tool allowlists, approvals, memory and retrieval scans, MCP pins, and NVIDIA NeMo Guardrails.
• Real agent and MCP targets: a tool-calling agent with a visible plan, tool calls, and approvals, plus real stdio MCP servers (official, community, and untrusted lookalike).
• Poisonable knowledge base: inject documents into the RAG pipeline, spoof trust tiers, stuff retrieval keywords, and flood the context window.
• Learn pages: the three OWASP lists with labs and challenges mapped to each risk, and a threat modeling guide with an architecture diagram and six worked scenarios.
• Local-first: no cloud accounts and no API keys. Internet is only needed for the first setup.

---

Who Is AIGoat For?

• Security engineers and red teamers building LLM, agent, and MCP attack skills against a consistent, repeatable target.
• Workshop facilitators and educators who need a platform participants can start in minutes (see the workshop guide). CTF challenges are auto-graded.
• Researchers testing guardrail effectiveness and prompt injection variants.
• Teams securing agents and MCP integrations who want to see goal hijack, tool misuse, memory poisoning, and tool-description attacks first-hand.

LLM security is different from traditional application security. Prompt injection does not behave like SQL injection, and RAG poisoning has no equivalent in the OWASP Web Top 10. You learn it by practicing on a target.

---

Quick Start

Pick one way to run AIGoat:

Local one-command start

Prerequisites

git clone https://github.com/AISecurityConsortium/AIGoat.git
cd AIGoat
./scripts/start.sh

The script checks Python 3.11, Node.js 18 or newer, and config/config.yml, creates the virtualenv, checks Ollama and pulls the configured chat model if it is missing, applies the database migrations (a pre-Alembic database is stamped at revision 0001 first, then migrated), seeds demo data, and starts the backend and frontend. It also checks for the tool-calling model (ollama.agent_model, or qwen3.5:9b by default) that the agent, MCP host, and kill chain labs need, and warns with the install command if it is missing. Set AIGOAT_PULL_AGENT_MODEL=1 to have it pulled for you (about 6.6 GB). It waits until the API and the app answer before it prints “AI Goat is running!”. Then open:

Tool-calling labs need a tool-capable model. Mistral is enough for the chat and RAG labs. The agent labs, the MCP host labs, and the Agentic Kill Chain need a model with native tool calls, for example ollama pull qwen3.5:9b. Pick it in the model dropdown of the agent consoles and the kill chain workbench, or set ollama.agent_model in config/config.yml. If a model ignores a planted instruction, the lab reports that honestly instead of faking the result.

Google Colab

No local install needed. The notebook runs Ollama, the backend, and the frontend inside a Colab runtime.

1. Click Open in Colab above (or upload colab_notebooks/AIGoat_Colab.ipynb with File → Upload notebook).
2. Select Runtime → Change runtime type → T4 GPU. CPU works, but replies take 30 to 60 seconds.
3. Optional: keep cell 7b enabled to add qwen3.5:9b for the agent, MCP host, and kill chain labs.
4. Select Runtime → Run all. The first run takes 10 to 15 minutes.
5. Open the application link printed by step 12 of the notebook.

Use the link Colab prints, not localhost. In Colab, http://localhost:3000 exists only inside the Colab VM and will not open from your browser. Step 12 prints the app on Colab’s own domain (an HTTPS address that contains 3000), plus a separate port 8000 link for the API docs at /docs. The links only work in a browser signed in to the same Google account, and they expire when the runtime disconnects.

Read the Google Colab guide for requirements, the URL details, and troubleshooting.

Docker

Requires Docker Desktop with at least 12 GB RAM allocated. See Hardware Requirements.

docker volume create ollama_models
cd docker
docker compose up --build

Docker starts three containers: backend, frontend (Nginx), and Ollama. On first run the backend pulls Mistral (about 4.5 GB). The ollama_models volume keeps the model across restarts, so it downloads once. To use a different model, edit docker/config.yml.

Docker is reachable from your network. Published ports bind to 0.0.0.0, so other machines on the same network can open http://:3000 (API at :8000, Ollama at :11434). Use it only on a trusted network. Do not set REACT_APP_API_URL to http://localhost:8000 in the frontend image, or remote browsers will call their own machine. Nginx already proxies /api/ and /media/ to the backend.

Login credentials

The header has a Switch to Admin shortcut. The admin assistant, the RAG page, and the Agentic Kill Chain are staff-only.

Stopping and resetting

./scripts/stop.sh          # stop everything
./scripts/start.sh --fresh # delete the database and vector store, then restart

Agent and MCP labs can also be reset from their lab console. From the shell, the scripts/labs/ helpers default to port 8001, so point them at the backend and pass a bearer token:

export AIGOAT_API=http://localhost:8000
export AIGOAT_TOKEN=$(curl -s -X POST $AIGOAT_API/api/auth/login/ -H 'Content-Type: application/json' \
  -d '{"username":"alice","password":"password123"}' | python3 -c 'import sys,json; print(json.load(sys.stdin)["token"])')
scripts/labs/reset.sh asi02-1   # also: setup.sh, run.sh   "", halt.sh

---

Tour of the Application

The defense level toggle (L0, L1, L2) in the header applies to the lab or chat you are using. Each lab shows what to try and what to expect at each level.

---

Attack Scenarios: OWASP LLM, Agentic, and MCP Security Labs

Labs are defined in config/labs/*.yml. Each is tagged with a framework risk, an attack surface, and a difficulty, and shows example prompts and the expected result at each defense level.

OWASP Top 10 for LLM Applications (2026): 23 labs

OWASP Top 10 for Agentic Applications (2026): 12 labs

One lab per risk, run against the tool-using agent or the MCP host. Levels 0, 1, and 2 describe security maturity, not difficulty.

The 12th lab is the Agentic Kill Chain capstone (below). Guides: Agentic labs, architecture inventory, and per-risk notes in docs/agenttop10.

OWASP MCP Top 10 (2025, beta): 11 labs

Labs run against real stdio MCP servers shipped with AIGoat: an official catalog, a community support server, an untrusted lookalike, and an internal management server. Servers are allow-listed in config/mcp_servers.yml, and a request can never choose the command to run. Nine of the ten risks are covered; MCP05 (command injection) is documentation-only.

---

Agentic Kill Chain: The Compromised eCommerce Agent

The capstone lab (killchain-1) shows why agent memory poisoning is more than a one-shot prompt injection. It runs in its own workbench at /challenges?killchain=1 (staff only, best with a tool-capable model).

1. Plant a hidden instruction in untrusted content: a product review, or a PDF invoice attached to a support ticket (white 7 pt text a person never sees).
2. Persist: a naive ingestion pipeline copies it into connector memory, and the agent derives standing notes into its own memory.
3. Trigger: a routine request such as “summarize today’s tickets” retrieves the note, and the agent calls a tool nobody asked for.
4. Impact: a mock export email to [email protected] with BCC [email protected] carrying demo customers, the internal coupon list sent to the attacker, or a $1.00 price quote using the learned coupon (a confused-deputy quote, not a real order).
5. Defend: in Defended mode the poison stays and the agent proposes the same calls, but the backend holds each sensitive operation for an administrator approval bound to the exact arguments.
6. Survive a wrong approval: in Guardrailed mode the administrator is still asked, but deterministic rails then check the call itself: an egress allowlist (only @aigoat.co.in), card-number masking, a staff-coupon rule and an ingestion scan that quarantines instruction-like hidden text. Approve the attacker export on purpose and the guardrails still refuse it. The ingestion scan is a pattern match that a reworded instruction can slip past, which is why the later rails exist.

The workbench includes a live trace, a memory inspector, the attacker inbox, layered cleanup operations, and a hard reset. Lab data is copied from the shop and the lab never writes to the shop’s tables. Nothing leaves your machine: “email” is a database row. Full walkthrough: Agentic Kill Chain guide.

---

Defense Levels: From Vulnerable to Guardrailed

Each attack surface has its own profile in config/defense_profiles.yml (Level 0 is always empty):

The Agentic Kill Chain uses its own Vulnerable, Defended and Guardrailed switch instead of L0 to L2. Every guardrail, the attacks it targets, and its limits are documented in the Guardrails guide.

---

AI Security CTF Challenges

Each challenge has its own chat window. When your exploit succeeds, a flag (AIGOAT{...}) appears in the response. Flags are derived per user at runtime and cannot be found in the source code.

Total: 2,100 points. Solutions are intentionally not published in this repository.

---

AIGoat Architecture

Browser
  │
  ▼
React frontend (:3000)  ──  /api and /media proxied to the backend
  │
  ▼
FastAPI backend (:8000)
  ├── Defense pipeline: one profile per surface and level
  │     L0 passthrough · L1 validate → classify → policy → moderate · L2 NeMo rails + approvals
  ├── Surfaces: chat.cracky · rag.kb · agent.runner · mcp.client · mcp.host
  │     ├── Shop agent and admin tools (Intent Gate → gated loop → tool registry)
  │     ├── MCP host and client (allow-listed stdio servers)
  │     └── Agentic Kill Chain workbench (lab-owned kc_* tables)
  ├── Challenge engine (9 evaluators + HMAC flag generator)
  ├── RAG (ChromaDB + all-MiniLM-L6-v2 embeddings)
  └── SQLite (Alembic migrations)
  │
  ▼
Ollama (:11434), Mistral by default

Every chat message passes through the defense pipeline for the active level before it reaches Ollama, and the reply passes through output checks before it reaches you. Agent and MCP labs route every tool call through an Intent Gate that applies the active defense profile before the tool runs.

---

Project Structure

AIGoat/
├── app/                    FastAPI backend
│   ├── agent/              Shop and admin agent: Intent Gate, gated loop, tools, memory
│   ├── api/                API route handlers
│   ├── challenges/         Flag engine and exploit evaluators
│   ├── core/               Config, database, security, lab and framework loaders
│   ├── defense/            Defense controls, per-surface profiles, NeMo adapters
│   ├── labs/killchain/     Agentic Kill Chain backend
│   ├── mcp/                MCP host, registry, stdio launcher
│   ├── mcp_servers/        Shipped (intentionally flawed) stdio MCP servers
│   ├── models/             SQLAlchemy models
│   ├── rag/                Knowledge base retrieval
│   ├── services/           Business logic (cart, orders, chat, challenges)
│   └── surfaces/           Attack surface registry
├── alembic/                Database migrations
├── colab_notebooks/        Google Colab notebook and guide
├── config/
│   ├── config.yml          Main configuration
│   ├── defense_profiles.yml  Controls per surface and level
│   ├── frameworks/         OWASP LLM 2026, Agentic 2026, MCP 2025 risk lists
│   ├── labs/               Lab definitions (llm, rag, agent, mcp)
│   └── mcp_servers.yml     Allow-listed MCP servers
├── docker/                 Docker Compose setup and Docker config
├── docs/                   Workshop guide, Agentic labs, Kill Chain guide, Agent Top 10 notes
├── frontend/               React 18 + Material-UI app
├── guardrails/             NeMo Guardrails config (Level 2)
├── prompts/                System prompts per level, lab, and challenge
├── scripts/                start.sh, stop.sh, seed.py, labs/ (setup, run, reset, halt)
├── tests/                  Backend tests (pytest)
├── media/                  Product images, logo, diagrams
└── agent-docs/             Notes for AI coding agents working on this repository

---

Hardware Requirements

Mistral 7B needs about 4.5 GB of RAM. Without at least 8 GB of free RAM, the chatbot will not work. Short on RAM? Use Google Colab.

Without a GPU, replies take 10 to 30 seconds. With one, 1 to 3 seconds. Ollama uses the GPU automatically. Docker users: allocate at least 12 GB RAM to Docker Desktop.

---

Configuration

Settings live in config/config.yml (Docker uses docker/config.yml):

ollama:
  base_url: "http://localhost:11434"
  model: "mistral"
  agent_model: null   # optional tool-capable model for agent and MCP labs, e.g. "qwen3.5:9b"

rag:
  enabled: true
  top_k: 5            # knowledge base documents retrieved per query

agent:
  max_steps: 8        # tool-call steps per agent turn

The defense level is chosen per user with the header toggle. Lab content lives in config/labs/, framework risk lists in config/frameworks/, and per-surface defenses in config/defense_profiles.yml.

---

Troubleshooting

---

Security Notice

AIGoat is intentionally vulnerable software. The vulnerabilities are features, not bugs.

• Intentional (do not report): prompt injection, system prompt extraction, RAG and memory poisoning, MCP tool poisoning, agent excessive agency, data leakage, XSS via chatbot output at Level 0, weak default credentials, the demo persona switch.
• Unintentional (please report): authentication bypass, arbitrary code execution on the host, container escape, SQL injection, path traversal. See SECURITY.md.

---

FAQ

What is AIGoat (AI Goat)?

AIGoat is an open source, deliberately vulnerable AI security playground. You practice LLM, agentic AI, and MCP attacks against a real local model, then switch on defenses to see which attacks still work.

Is AIGoat free?

Yes. The platform code is Apache 2.0, and the training content is free for learning, research, and non-commercial use under CC BY-NC-SA 4.0. Commercial training use needs permission (see Licensing).

Do I need an OpenAI API key or a GPU?

No API key is needed: AIGoat runs Mistral locally through Ollama. A GPU is recommended for speed but not required. You need about 8 GB of free RAM, or you can use Google Colab instead.

Can I run AIGoat on Google Colab?

Yes. Click Open in Colab, choose a T4 GPU runtime, and run all cells. Open the link the notebook prints on Colab’s own domain, not localhost. See the Colab guide.

Which OWASP risks does AIGoat cover?

All ten risks of the OWASP Top 10 for LLM Applications 2026, all ten of the OWASP Top 10 for Agentic Applications 2026, and nine of the ten OWASP MCP Top 10 risks. MCP05 is documented but has no lab, by design.

How is AIGoat different from other vulnerable LLM apps and AI CTFs?

Beyond a chatbot, AIGoat includes a tool-calling agent, real MCP servers, agent memory, and an end-to-end agentic kill chain. Every attack surface has three defense levels, so you learn both the attack and the mitigation.

Can I use AIGoat for workshops and university courses?

Yes. Participants can start it in minutes, CTF challenges are auto-graded, and the workshop guide covers running a session.

---

Resources and Community

Questions, ideas, and bug reports are welcome as GitHub issues and pull requests.

---

Licensing

AIGoat uses two licenses to keep the platform open while protecting training content.

Platform code: Apache License 2.0. The application code (app/ except app/challenges/, frontend/, guardrails/, scripts/, docker/, alembic/, tests/, agent-docs/, colab_notebooks/, config/config.yml, config/defense_profiles.yml, config/mcp_servers.yml) can be used, modified, and distributed, including commercially. See LICENSE.

Training content: CC BY-NC-SA 4.0. The educational material (app/challenges/, prompts/, docs/, media/, config/labs/, config/frameworks/) is licensed under Creative Commons BY-NC-SA 4.0. Free for learning, research, and non-commercial use. Commercial training use requires permission. See TRAINING_LICENSE.md.

Trademark Notice

AI Goat is a registered trademark of AISecurityConsortium. The name, logo, and branding may not be used in connection with any product or service without prior written permission. Non-commercial references in academic papers, blog posts, and conference talks are permitted.

---

AIGoat (AI Goat) is an open source AI security playground and LLM security lab for prompt injection testing, AI red teaming, agentic AI security, and MCP security training, mapped to the OWASP Top 10 for LLM Applications, the OWASP Top 10 for Agentic Applications, and the OWASP MCP Top 10.

aigoat.co.in

Made with care by Farooq and Nal at AISecurityConsortium