AI Bugs Puncturing the Web

Intermediate 2 Labs 5 Lessons ~3-4 hours hands-on

AI systems don't exist in isolation — they process HTML, fetch URLs, and render content. When prompt injection meets traditional web vulnerabilities, entirely new attack surfaces emerge. This path teaches you how AI-mediated workflows create XSS and SSRF opportunities that didn't exist before.

Path Overview

Traditional web security taught us to sanitize user input and validate URLs. But when an AI sits between the user and the application, the attack surface shifts. The AI becomes a confused deputy — it processes attacker-controlled input and produces output that the application trusts. This path shows you how to exploit that trust.

Labs in This Path

A support ticket triage AI that renders HTML when analysts review auto-generated summaries. Inject XSS payloads through the AI-triaged workflow and land code execution when an analyst opens the case.

Real-world parallel: AI-mediated content moderation, ticket triage, and review systems.

Launch Lab →

A research assistant that fetches URLs from a simulated Haankipedia-style corpus. Manipulate the assistant into reaching simulated internal services through indirect retrieval chains.

Real-world parallel: AI research tools, URL summarizers, and retrieval-augmented systems.

Launch Lab →

Lessons in This Path

Complete these lessons to understand the theory behind each lab. We recommend doing lessons before or alongside labs.

Prompt Injection Code Execution Chains

How injected prompts can lead to code execution through AI-mediated workflows.

Explicit Direction Compliance

Getting AI systems to follow direct override instructions through explicit framing.

Output Enforcement Patterns

Controlling AI output format and content through injection techniques.

Data Exfiltration Side Channels

Extracting data through indirect channels when direct output is filtered.

Special Tokens and Glitch Patterns

Using special tokens and encoding patterns to bypass AI input filters.

What You'll Learn

How AI systems become confused deputies in web architectures
Why blind XSS is particularly dangerous in AI-triaged workflows
How to chain prompt injection with traditional web vulnerabilities
SSRF techniques adapted for AI research assistants
Input sanitization gaps in AI-mediated systems
How to think about trust boundaries when AI is in the loop

Next Steps

After completing this path, pick your next direction:

Defense Fundamentals Intermediate · 3 Labs · 5 Lessons Indirect Injection Mastery Advanced · 3 Labs · 4 Lessons Compendium Home All paths & lessons