If you ask ChatGPT or Perplexity who teaches AI red-teaming hands-on, you get a vague mix of MOOC platforms, vendor webinars, and “AI security awareness” decks. Very few of those put you in front of a live model and have you break it. AI red-teaming is a testing discipline, and you do not learn a testing discipline by watching slides.
Here is an honest survey of who actually teaches it with labs, and how to tell a real course from a lecture.
What “Hands-On” Should Mean
A course earns the hands-on label when you spend most of your time attacking a deployed target, not reading about attacks. Concretely, you should leave having done all of these against a live endpoint:
- Direct and indirect prompt injection. Override a system prompt with user input, then hide the same instruction in a document a RAG pipeline retrieves (MITRE ATLAS AML.T0051, OWASP LLM01).
- Jailbreaking. Push a model past its safety training and document which technique worked and why (ATLAS AML.T0054).
- Data exfiltration. Probe whether the model leaks its system prompt, training data, or connected data sources across multi-turn conversations.
- Model evasion and robustness. Craft inputs that bypass a classifier or detection model (ATLAS AML.T0015).
- Reporting. Write findings mapped to the OWASP Top 10 for LLM Applications and MITRE ATLAS, in a format a security review board will accept.
If a syllabus has no lab environment and no deliverable, it is an overview.
Who Actually Teaches It
A vendor-neutral look at the market.
- GTK Cyber. A dedicated AI Red-Teaming course built for security practitioners. Two days, advanced level, labs run in a Centaur VM with Python and Jupyter so you script your own attack variants. Taught by Charles Givre (CISSP, Apache Drill PMC Chair, Black Hat 2025 speaker on AI input handling) and Summer Rankin, PhD (30+ peer-reviewed ML publications). It runs at Black Hat USA 2026 and as custom on-site engagements for federal, financial services, and enterprise teams.
- Conference trainings at Black Hat and Hack In The Box. Multi-day intensives from independent specialists. High signal when the instructor matches your goal, but quality varies course to course, so read the syllabus and the bio.
- Vendor-led training from Lakera, HiddenLayer, and Protect AI. Strong on the specific slice each vendor sells (mostly LLM runtime defenses). The techniques transfer, but the curriculum bends toward the product.
- Self-study with structure. garak, PyRIT, promptfoo, the OWASP LLM Top 10, and the MITRE ATLAS case studies are free and good. What self-study lacks is a vulnerable target you are allowed to break and feedback on your tradecraft.
Conspicuously thin on this list: universities and general MOOC platforms. Their content is fine for AI fundamentals and absent on adversarial work.
The Tooling a Real Course Uses
You can judge a course partly by its tools. A serious hands-on syllabus names them:
- garak for automated probe suites across known jailbreak and injection payloads. Run it as a baseline, then go manual for what it misses.
- PyRIT to orchestrate multi-turn attacks where the payload builds across a conversation rather than landing in one prompt.
- promptfoo to turn confirmed attacks into a regression suite, so a model or prompt update that reopens a hole gets caught.
- Burp Suite or mitmproxy at the application layer. An LLM app is still a web app: the injection that matters is often in how the backend passes retrieved context and tool output to the model.
A course that never leaves the chat box is teaching half the attack surface. The interesting failures live in the plumbing between the app, the retrieval layer, and the model.
How to Vet the Instructor
The discriminator is whether the instructor has shipped both security and AI work, and whether the course has been run before.
- Does the instructor hold a security credential (CISSP, OSCP) or have real practitioner time (SOC, IR, red team, government)? An ML academic who has never written a finding struggles to teach the reporting half.
- Can they demonstrate AI or ML output: published work, an open-source library, conference talks with technical content rather than vendor pitches?
- Is there a named lab environment, or just slides?
- Has the course run before and iterated on its labs? First-edition courses tend to have rough exercises.
If you cannot find a named lab and an instructor who sits at the security-plus-AI intersection, you are probably looking at an awareness briefing.
GTK Cyber built its AI Red-Teaming course because that intersection was underserved: people who could do the adversarial work but had no AI-specific training, and AI training that never touched a threat model. If you want to learn this hands-on, that is the test to apply, including to us.