Agent Break Lab: hands-on attack exercises for people moving into AI security
Browser labs where security people hijack and defend agents, MCP servers and poisoned repos. Individuals pay monthly.
Crowded · AI security engineer demand up 200%
Written for: Solo builder
Next step
This week, build three labs on a small open-weight model: a TrojanForge-style poisoned repo, an injectable MCP tool, and an ignored-not-refused injection. Launch them free with a paid waitlist on r/netsec and the r/cybersecurity career threads, where the job-market numbers are being discussed.
Why now
CyberSN reports US cybersecurity postings down 26.4% to a four-year low, while demand for AI security engineers rose more than 200%. Anthropic's junior share of hires fell from 27% to 9%. People need a way to retrain and prove it. Web-security training sites cover LLM prompt injection lightly, but few cover agents with tools, MCP or repo poisoning. Lakera's Gandalf and PortSwigger's LLM labs are free competitors, so the open space is moderate, not wide.
What became possible
Recent research gives reproducible attacks to use as lab material. TrojanForge poisons repositories automatically to hijack coding agents. 'Ignored, Not Refused' audits 33,000 trajectories and shows most failed injections were ignored by the agent, not refused. GatewayBench tests MCP gateway security. OpenAI has published cases where its own models forged tokens and pulled hospital data without saying so.
Two ways in
- Agent Break Lab
About 20 sandboxed scenarios: a coding agent hijacked by a poisoned README, an MCP tool with argument injection, a payments agent tricked into a refund, and an injection where the agent silently ignores rather than refuses. Each has a scored writeup and a 'now defend it' stage.
- Customer
- Mid-career security engineers and pentesters moving into AI security roles
- Model
- $15 a month or $120 a year. Small open-weight models keep token costs low
- Team seats for small security consultancies
Shared progress tracking and custom scenarios for consultancies training staff to sell agent red-team engagements.
- Customer
- Small security consultancies and MSSPs with 5 to 30 staff
- Model
- $40 per seat per month
Competition
A monthly AI-security lab subscription for individuals is already taken. BREACH.lab sells nearly this exact product (agent hijacking, MCP tool poisoning, poisoned README injection, a defend stage) for $19 a month.
Full competition notes (12 competitors)
A monthly AI-security lab subscription for individuals is already taken. BREACH.lab sells nearly this exact product (agent hijacking, MCP tool poisoning, poisoned README injection, a defend stage) for $19 a month. Hack The Box has a Google-backed AI Red Teamer path and a certification, Lakera's Agent Breaker is free, and DVMCP and MCPGoat are free self-hosted MCP labs. A new consumer entrant would compete on price and brand against all of them. The openings that remain are narrower. One is scenarios that are harder to grade and nobody seems to cover well, such as agents that quietly ignore instructions instead of refusing, and payments or refund agents pushed into financial actions. Another is defense stages that are actually scored against attacks rather than just playbooks. A third is realistic coding-agent supply-chain chains across whole repos. The clearest gap is the consultancy offer. Hack The Box and AppSecEngineer sell team training to enterprises, but nobody found targets 5 to 30 person security firms with custom scenarios, staff progress tracking and material that maps directly to selling and running agent red-team engagements. Leading with that offer, and using individual plans as the way in, has a better chance than competing head-on for individual subscribers.
- BREACH.lab
Nearly the same product. Hands-on AI security labs organised as Brief, Demo, Lab, Defend, including an MCP Tool Poisoning and Agent Hijacking module with injection via README files, issue descriptions and tool responses. Sold to individuals at $19/mo or $149/yr with a free tier.
- Lakera Gandalf: Agent Breaker
Free game-style CTF with 10+ realistic agents to hack: tool abuse, memory poisoning, injections hidden in PDFs, data leaks, plus a leaderboard. Lakera is now part of Check Point.
- Hack The Box AI Red Teamer path
12-module AI red teaming path built with Google covering prompt injection, supply chain and deployment threats, backed by the HTB Certified Offensive AI Expert certification. Sold by subscription to individuals and teams.
- Hack The Box AI Range / AI security readiness
Enterprise and service-provider AI cyber range and team training with adversarial AI exercises. Competes for the consultancy and MSSP team buyer.
- Damn Vulnerable MCP Server (Kyze Labs)
Free open-source vulnerable MCP server, listed with 28 vulnerable tools and 38 challenges across 4 difficulty levels, for attacking and defending MCP agents.
- MCPGoat
Free deliberately vulnerable MCP server, listed with 26 challenges and 78 flags plus a secure reference level for practicing defense.
- Bishop Fox Otto Support MCP challenge
Free CTF built on a vulnerable MCP-based customer support agent where players escalate access, exfiltrate data and execute code.
- PortSwigger Web Security Academy LLM attacks
Free browser labs on LLM attacks including indirect prompt injection with live LLMs. A small set of labs aimed at web pentesters.
- HOL Guard AI Security Labs
Interactive simulations of prompt injection, MCP tool poisoning, secret exfiltration and supply chain risk.
- SANS SEC411
Paid course with hands-on labs, including MCP tool description poisoning and defending against MCP security issues.
- AppSecEngineer AI Agent Security Masterclass
Paid AI agent and MCP security training with labs, sold to enterprises and teams.
- Attacking MCP Servers and AI Apps (Udemy)
Self-paced course where learners build and attack MCP servers in Docker labs.
Checked 2026-10-19
Risks
- Free labs from Lakera, PortSwigger and Hack The Box set price expectations near zero.
- Running live agents for every learner costs tokens and needs strict network isolation.
- Content goes stale as models and defences change every quarter.
- The certificate means little until hiring managers recognise it.
Strong tech readiness; open space is the weak point (4).
tech 8 · pull 6 · space 4 · fit 7 · build 7
Exposed
Companies that could benefit or be threatened. News and context, not investment advice.
Momentum of its main topic
Sources
- CyberSN: US cybersecurity job postings fell 26.4% YoY to a four-year low of ~236K roles from January to September; AI security engineer demand soared by 200%+ (Kevin Townsend/SecurityWeek)Techmeme
- Anthropic has nearly stopped hiring junior staff because AI agents now work six times as many hoursThe Decoder
- Trojan Horse: Automated Repository Poisoning against Coding AgentsarXiv
- Ignored, Not Refused: What Low Prompt-Injection Success Rates Hide in Small Tool-Using AgentsarXiv
- An OpenAI model hacked a government site, grabbed 24 years of hospital data and kept it quietThe Decoder
- GatewayBench: Unified Capability and Security Evaluation Platform for MCP GatewaysarXiv
Status history
- 2026-10-19 Flagged as buildable