Build a compact security regression suite for prompt injection

1. 01

   Concepts & system design

   60 min· read · map the mechanismtimer

   R28 — Microsoft PyRIT targets & scoring

   R29 — Garak probes & detectors

   R04 — OWASP LLM Top 10

   Read the assigned sections; map the mechanism, threat model and trade-offs.

2. 02

   Project implementation

   120 min· build · integrate · debugtimer

   Build the deterministic fast security regression suite (D8 PR gate: 20–50 cases covering prompt injection, BOLA/tenant isolation, unauthorized tool calls, output schema violations, and citation spoofing). Configure it to trigger automatically whenever model, provider, prompt, or tool schemas change.

   Build, integrate, debug and improve the increment in the active project.

3. 03

   Security lab

   60 min· attack your own systemtimer

   Seed a deliberate tool-authorization regression and verify the PR security suite catches it deterministically.

   Test the abuse case, failure path, authorization bypass or resource limit.

4. 04

   Verification & evidence

   30 min· test · record evidencetimer

   Versioned deterministic security test corpus + CI trigger configuration.

   Add or run regression tests; record the 9-point evidence record.

5. 05

   Deliberate practice & Socratic review

   30 min· explain aloud · update gapstimer

   Answer the 8 Socratic questions without notes: What? Why? How? What if? Why not? How can I prove it? Where can it break? What have I learned?

   Re-explain the hardest concept aloud, inspect one edge case, update the gap log.

6. total5 h

• R04OWASP Top 10 for LLM Apps↗ genai.owasp.org

  Prompt injection, sensitive info disclosure, improper output handling, excessive agency, vector weaknesses, unbounded consumption.

• R28Microsoft PyRIT↗ github.com

  Python Risk Identification Tool: targets, orchestrators, converters, scorers, and multi-turn attack automation.

• R29Garak Documentation↗ garak.ai

  LLM vulnerability scanner architecture: probes, generators, detectors, and buffs (authorized targets only).

Read only the named sections needed for today's task. Reading sits inside the 60-minute concepts block; it is not extra time.

• docsOWASP Gen AI Security Project
  OWASP Top 10 for LLM Applications

  The risk catalogue your 20–50 PR cases must map to: prompt injection, sensitive information disclosure, improper output handling, excessive agency, and unbounded consumption.

  R04checked 2026-11-11
• repoMicrosoft (GitHub)
  PyRIT: The Python Risk Identification Tool for generative AI

  Provides targets, orchestrators, converters, and scorers as Python objects, which is what lets a deterministic case list run as a fast, non-interactive PR gate.

  R28checked 2026-11-11
• videoMicrosoft Developer
  Episode 8: Automating AI Red Teaming with PyRIT | AI Red Teaming 101

  Shows a PyRIT run from initialisation through orchestrator, target, and scorer against a live endpoint, the same shape as a scripted regression case.

  R28checked 2026-11-11
• videoKiso Secure
  LLM Vulnerability Scanning With Garak | AI Security Testing

  Runs garak probes against a local model in an isolated lab and reads the detector output, showing how probe/detector pairs become pass-fail assertions.

  R29checked 2026-11-11
• articleKunal Ganglani
  Prompt Injection Regression Testing [2026 CI Guide]

  Describes a CI-ready suite with seed corpora, adversarial transforms, canary secrets, and hard-fail gates — the design pattern for triggering D8 on prompt, model, or tool-schema changes.

  R04checked 2026-11-11

A lab is complete only when it produces evidence. Installing PyRIT, Garak, Presidio or TransformerLens is not completion. Saved on this device only.