PortSwigger Web LLM Attacks: Lab Index & Writeups

PortSwigger’s Web Security Academy has a small, sharp topic called Web LLM attacks - eight labs (and counting) on attacking LLM-backed web apps: mapping what a model can reach, abusing its tools, and treating its output as the untrusted input it really is.

This page is my index for that track. Each lab links to the full writeup - which lives under its matching OWASP LLM Top 10 (2026) category, because I file deep writeups by what the bug is, not which platform hosted it. This is just the PortSwigger-shaped view of the same content.

---

The track, mapped to OWASP

#	Lab	Difficulty	OWASP category	Writeup
1	Exploiting LLM APIs with excessive agency	Apprentice	LLM03 Excessive Agency	Read it
2	Exploiting vulnerabilities in LLM APIs	Practitioner	LLM03 / LLM10	Read it
3	Indirect prompt injection	Practitioner	LLM01 Prompt Injection	Read it
4	Exploiting insecure output handling in LLMs	Expert	LLM10 Improper Output Handling	coming soon
5	Exploiting AI agents to perform destructive actions	Apprentice	LLM01 / LLM03	coming soon
6	Exploiting AI agents to exfiltrate sensitive information	Apprentice	LLM02 Sensitive Info Disclosure	coming soon
7	Exploiting AI agents to trigger secondary vulnerabilities	Practitioner	LLM10 / chained	coming soon
8	Bypassing AI scanner defenses to exfiltrate sensitive information	Practitioner	LLM02 Sensitive Info Disclosure	coming soon

---

Why this track is worth doing

The whole set drills one mindset shift: an LLM plugged into your app is an attack surface, not a feature. The labs walk it from easiest to nastiest:

• Excessive agency - the model has a tool it never should (raw SQL), and will use it for anyone who asks. Recon is the exploit.
• Vulnerable backend APIs - the model faithfully calls an internal API that has a classic bug (e.g. command injection), so you attack through the model.
• Indirect prompt injection - you plant instructions in content the model later reads, and it acts on them with the victim’s privileges.
• Insecure output handling - the app trusts the model’s output and pipes it into a browser/query, reviving XSS and friends.

Then there’s the newer AI-powered scanner vulnerabilities sub-track (rows 5-8), where the “victim” isn’t a person but an automated AI scanner/agent: you plant poisoned content on a target site, the scanner ingests it, and it performs destructive actions, exfiltrates data, or triggers secondary bugs - indirect prompt injection aimed at a machine instead of a human.

Notice how neatly that lines up with OWASP: PortSwigger’s track is basically LLM03 → LLM10 → LLM01 → LLM10 in a different order. If you’ve read the field guide, you already have the theory; these labs are the hands-on reps.

---

Working through the rest of the track now - this page updates as each writeup lands. Want to compare solutions? Reach out.