Cyber & AI Security · Internship Role
AI APPLICATION SECURITY
Test AI apps for prompt injection, data leaks and insecure tool use, then help developers fix what you find.
SKILLS YOU'LL WALK AWAY WITH
OWASP LLM Top 10Prompt injectionThreat modellingSecure AI designWriting findings
PROOF-OF-WORK TASKS8 TASKS
Start at Beginner and work up. Every task produces something real you can show: a report, a tool, a guide or a demo. Publish it on LinkedIn or GitHub as your proof of work.
B
Beginner
LEVEL 01
- 01Beat as many Lakera Agent Breaker challenges as you can. Write up the technique that worked at each level and why the defence failed.
- 02For each risk in the OWASP Top 10 for LLMs, write one realistic scenario in an Indian app (a banking bot, an edtech tutor, an HR screener).
- 03Explain direct vs indirect prompt injection with a simple diagram and two examples.
I
Intermediate
LEVEL 02
- 01Complete the PortSwigger Web LLM attacks labs and publish a write-up for each in your own words, with your reasoning rather than copied solutions.
- 02Build a small vulnerable RAG app on your own machine, exploit it with indirect prompt injection through a planted document, then fix it.
- 03Threat-model an AI support bot that has tool access (refunds, order lookup): a data-flow diagram, trust boundaries, and the top 10 threats with mitigations.
A
Advanced
LEVEL 03
- 01Run a full assessment of Damn Vulnerable LLM Agent or your own AI app, with scope, test cases, findings with severity, reproduction steps and fixes, in a professional report format.
- 02Build a reusable test suite of 50 attack prompts across injection, leakage and jailbreak categories, and run it against two configurations of your own app.
HAND-PICKED FREE RESOURCES7 RESOURCES
FREE COURSE
PortSwigger: Web LLM Attacks
Free hands-on labs exploiting real LLM-integrated apps.
VISIT RESOURCE
FREE COURSE
PortSwigger Web Security Academy
The best free web security training anywhere.
VISIT RESOURCE
FREE TOOL
Lakera Agent Breaker
The successor to Gandalf: hack realistic AI agents with prompt injection, legally.
VISIT RESOURCE
FREE TOOL
promptfoo
Open-source tool to test prompts and AI apps against test cases and attacks.
VISIT RESOURCE
CODE REPO
Damn Vulnerable LLM Agent
An intentionally vulnerable AI agent to practise attacks on, legally.
VISIT RESOURCE
ARTICLE GUIDE
OWASP Top 10 for LLM Applications
The industry reference list of the biggest security risks in AI apps.
VISIT RESOURCE
ARTICLE GUIDE
MITRE ATLAS
A knowledge base of real attacker tactics against AI systems.
VISIT RESOURCE