Meet LLMVault: A Hands-On Playground for OWASP LLM Top 10

I Built an Open-Source Lab to Learn the OWASP Top 10 for LLM Applications

Over the past few months, I've been exploring the security challenges around Large Language Models. While there are plenty of articles explaining prompt injection, system prompt leakage, insecure tool usage, and other LLM vulnerabilities, I kept asking myself one question:

Where can someone actually practice exploiting these vulnerabilities?

That's what led me to build LLMVault.

LLMVault is an open-source, intentionally vulnerable platform that helps developers and security professionals learn the OWASP Top 10 for LLM Applications (2025) through hands-on labs instead of theory.

Each lab simulates a vulnerable AI application inspired by real-world LLM attack scenarios. Instead of reading about prompt injection, you'll exploit it yourself, capture flags, understand why it worked, and then review the recommended mitigation. The objective is to bridge the gap between theory and practical AI security.

Why I built LLMVault

When learning web security, platforms like DVWA, WebGoat, and Juice Shop made learning practical.

For AI security, I couldn't find a similar project that was:

• Open source


• Self-hosted


• Free to use


• Designed around the OWASP LLM Top 10


• Built as a hands-on learning environment

So I decided to build one.

What is LLMVault?

LLMVault is a deliberately vulnerable AI application where every challenge demonstrates a real-world LLM security issue.

Instead of simply reading about prompt injection or system prompt leakage, you exploit vulnerable AI assistants, capture flags, and learn why the attack works.

Each challenge also includes defensive guidance so you understand how to prevent the same issue in production.

Features

• 🛡️ OWASP Top 10 for LLM Applications (2025)


• 💥 CTF-style challenges


• 🔍 Realistic AI attack scenarios


• 📚 Defensive explanations


• 🐳 Docker support


• 🔑 No API keys required


• 💻 Fully offline


• 🧩 Extensible challenge framework

Getting Started

Clone the repository:

git clone https://github.com/CyberSunil/LLMVault.git

cd LLMVault

Run using Docker:

docker compose up

Or install manually:

pip install -r requirements.txt

python app.py

Project Repository

👉 GitHub

https://github.com/CyberSunil/LLMVault

Who is LLMVault for?

• Security Engineers


• Penetration Testers


• AI Security Researchers


• Developers building LLM applications


• Students learning AI security


• CTF players

Documentation

You can find installation instructions, challenge documentation, screenshots, and contribution guidelines in the GitHub repository.

If you're interested in AI security, I'd love to hear your feedback or ideas for future challenges.