CyberSunil releases LLMVault, an open-source training lab for OWASP LLM security risks

CyberSunil has released LLMVault v1.0.0 as the first public version of an intentionally vulnerable AI security training platform.

A CTF-style lab for LLM application security

According to the GitHub release for CyberSunil/LLMVault v1.0.0, LLMVault is designed around the OWASP Top 10 for LLM Applications 2025 and provides 25 hands-on labs for practicing attacks and defenses against common risks in AI systems.

The project positions itself as an educational security range rather than a production tool. In a Medium introduction, Sunil describes LLMVault as an open-source, CTF-style environment where learners exploit vulnerable assistants, capture flags, and then study defensive fixes in a self-hosted sandbox.

That framing matters because many LLM security issues are difficult to understand from checklists alone. Prompt injection, unsafe tool use, retrieval-augmented generation failures, and agent misbehavior often depend on application context. A controlled lab gives defenders and testers a place to reproduce those patterns without targeting real services.

What the first public release includes

The GitHub release notes describe v1.0.0 as the initial public release and say it includes labs covering the full OWASP LLM Top 10 category set. The release also highlights coverage for prompt injection, agent security, and related GenAI penetration-testing scenarios.

Sunil’s Medium post says the platform is built for learners to move through deliberately vulnerable assistants, solve challenges, and understand how mitigations work. CN-SEC, a Chinese security publication, similarly describes LLMVault as an AI security training range covering all ten OWASP LLM Top 10 risks, with 25 tiered CTF labs, Docker deployment, and offline operation.

The release’s practical deployment details are notable. The GitHub release says LLMVault supports Docker and offline/no-key operation. That suggests users can run exercises locally without depending on paid API access for every scenario, a useful property for classrooms, workshops, and security teams that want repeatable lab environments.

Focus areas: prompt injection, RAG, and agents

The project’s stated scope aligns with several areas that have become central to LLM application security. Prompt injection remains one of the best-known attack classes, but modern AI applications often add retrieval systems, tools, and autonomous workflows that expand the attack surface.

A Zenn weekly repository roundup describes CyberSunil/LLMVault as an educational platform for testing intentionally vulnerable environments aligned with the OWASP LLM Top 10, including prompt injection, RAG security, and agent security. CN-SEC also emphasizes the platform’s coverage of the OWASP LLM Top 10 through tiered CTF-style exercises.

For retrieval-augmented generation systems, the relevant risks can include malicious or untrusted retrieved content influencing model behavior, leakage of sensitive context, or weak separation between instructions and reference material. For agentic systems, the risks can extend into tool execution, permissions, and unintended actions. LLMVault’s value will depend on how concretely its labs model these patterns and how clearly it connects exploitation steps to defensive controls.

Why it is useful for security training

The official release and supporting write-ups present LLMVault as a teaching platform for AI security, not as a benchmark or certification. That distinction is important: a vulnerable lab can help practitioners learn attack mechanics, but it does not by itself prove that a model, product, or organization is secure.

Still, intentionally vulnerable environments have a long history in application security training. Web security learners have used similar labs to practice SQL injection, cross-site scripting, broken authentication, and insecure deserialization. LLMVault applies that model to AI application patterns that are increasingly common in internal copilots, customer-support assistants, knowledge-base tools, and workflow agents.

The initial release gives security teams and educators a packaged environment for structured practice. The combination of OWASP mapping, CTF-style flags, Docker support, and offline/no-key operation may make it accessible for workshops and self-study, provided users validate the setup and review the underlying exercises for their needs.

Availability

LLMVault v1.0.0 is available from the CyberSunil/LLMVault GitHub release page. Sunil’s Medium article provides an introductory overview of the project and its training goals, while CN-SEC and Zenn have also published summaries describing the release and its alignment with OWASP LLM security topics.