Break AI systems.
Master the ones
that matter.

Hands-on, fully isolated labs where you hack LLMs, agents and real systems — guided by an AI that’s on your side. Go rookie → elite.

  • +100% isolated
  • +∞ resets
  • +no card required
28
tracks
175+
modules
2,000+
labs
300+
walkthroughs

You’re the newest member of Aegis

This isn’t a course. It’s a world.

Meridian Dynamics has everything worth attacking. Aegis defends it. NightShade wants it. You’re Nova — and you’re not learning alone.

  • Nova — youNovayou
  • Byte — AI allyByteAI ally
  • Sage — mentorSagementor
  • Ada — red teamAdared team
  • Max — blue teamMaxblue team
  • Vex — villainVexvillain

The adversary

You’re not here
for points.

You’re here to stop NightShade.

Vex has breached Meridian before — and he’ll do it again. Every exploit you learn is a weapon against him. Clear the labs. Then clear him out.

The NightShade Collective — Vex active · Glitch soon · Zero soon

Vex — leader of the NightShade Collective

AI-first labs

Hack LLMs, agents and MCP servers — the attack surface everyone is shipping now.

Real, isolated targets

Every lab is a live system in an ephemeral environment that is yours alone.

AI on your side

Byte hints, explains and grades your exploits in real time — you never get stuck.

Guided skill paths

Structured routes from first prompt injection to full agent takeover.

Earn & compete

Capture flags for XP, climb the ranks, and rise up a live global ladder.

Tracks

Attack the whole stack — 28 tracks.

Every domain of offensive and AI security, from foundations to bleeding-edge.

AI Security

LLMs · agents · MCP

AI Agentic

tool abuse · RAG

MCP

protocol attacks

Web & API

OWASP · injection

Red Team

AD · C2 · evasion

Blue Team

SOC · detection

Bug Bounty

recon · reporting

Cloud Security

AWS · K8s

Modules

200+ focused modules.

Each track breaks into modules — a tight set of labs on one skill.

Prompt Injection

AI Security · 34 labs

Agent Exploitation

AI Agentic · 28 labs

MCP Server Attacks

MCP · 22 labs

SQL Injection

Web & API · 31 labs

Active Directory

Red Team · 40 labs

Privilege Escalation

Red Team · 26 labs

Cloud IAM Attacks

Cloud · 19 labs

Malware Unpacking

Malware · 17 labs

Labs

2,000+ hands-on labs.

Isolated, real targets. Pick one, break it, capture the flag.

LLMEasy

Prompt Injection 101

Override a support agent's instructions and walk out with its system prompt.

+150Start
AI AgentMedium

Agent Takeover

Turn a tool-calling agent's own capabilities against it and seize control.

+250Start
AI AgentMedium

RAG Data Leak

Coax a retrieval-augmented assistant into leaking documents it should never expose.

+200Start
MCPHard

MCP Tool Poisoning

Poison a Model Context Protocol server and hijack every client that trusts it.

+300Start

Roadmap

Follow a path to a role.

Curated journeys that combine tracks and modules into a career path — like a skill tree from zero to hired.

AI Security Engineer

Break and secure LLMs, agents and MCP servers end to end.

AI Security · AI Agentic · MCP

Start path

Red Teamer

From first recon to full domain compromise and evasion.

Red Team · Web · Network · AD

Start path

Blue Team / SOC Analyst

Detect, investigate and respond to real intrusions.

Blue Team · DFIR · Threat Intel

Start path

Web Pentester

OWASP fundamentals through advanced app exploitation.

Web & API · Bug Bounty

Start path

Bug Bounty Hunter

Recon, find real bugs, and write reports that pay.

Recon · Web · Mobile · API

Start path

The shift

AI won’t take your job.
Someone who secures AI will.

Prompt injection, agent hijacking, MCP exploits — the attack surface moved. bugasm is built AI-first so you learn what the rest are only starting to teach.

Break LLMsHijack agentsExploit MCP

The loop

Launch. Break. Capture. Rank up.

  1. 01

    Launch an isolated lab

  2. 02

    Exploit the real target

  3. 03

    Capture the flag

  4. 04

    Earn XP & rank up

ProgressionPreview · sample data

Every flag moves a number.

Multi-axis mastery, a live rank, and a global ladder — progress you can feel.

Your rank

AGENT· #1,240 · top 8%
RecruitOperativeAgentSpecialistEliteLegend

Progress to Specialist

620 / 1000 XP

Skill mastery

Active DirectoryAI AgentsAI / LLMAPI SecurityMobileNetworkRed TeamWeb / App

Global ladder

  • 10xV1per4,820
  • 2nullbyte4,540
  • 3gh0st4,210
  • …you3,180
Full leaderboard

Why you can trust it

Truly isolated

Every lab is a single-tenant, ephemeral environment. Your exploits never touch shared infrastructure — and it's destroyed on exit.

AI-graded, not guessed

Byte evaluates the technique you actually used, not a flag string. Real feedback that answer-matching platforms can't give.

We practice what we teach

Coordinated vulnerability disclosure (security.txt) and a nonce-locked CSP + RBAC stack. Security-first, by design.

NightShade isn’t waiting.
Neither should you.

no card required · 100% isolated