Hacking 17 LLM Agents and 66 Planted Vulnerabilities in OWASP Agentic AI Goat: Abhinav Verma at Global AppSec USA 2026
OWASP Agentic AI Goat is a deliberately vulnerable platform with 17 LLM-powered agents, which hides 66 intentional vulnerabilities spanning the OWASP LLM, MCP and Web Top 10 lists.
Deliberately vulnerable apps such as WebGoat give people a safe target to practice attacks on. Agentic AI Goat applies that idea to multi-agent AI systems, with MCP tool calling and RAG pipelines in the mix.
RAG, or retrieval-augmented generation, feeds documents into a model's context at answer time. MCP lets agents call outside tools.
In his Global AppSec USA 2026 demo lab, "OWASP Agentic AI Goat: Hands-On Hacking of Multi-Agent LLM Systems", on Thursday, November 5 at 1:15 p.m. in Golden Gate, Abhinav Verma lets attendees attack a multi-agent AI system live.
Speaker: Abhinav Verma, Senior Staff Security Engineer, Intuit
Visitors can try prompt injection, RAG poisoning, MCP tool poisoning, privilege escalation through agent chaining and supply chain remote code execution.
A 10-level CTF has players extract secrets from AI guardians that get harder at each level. Their defenses adapt by learning the techniques attackers use against them.
The platform also includes SecureShop v2, an e-commerce app run by 3 supervisor agents and 17 task agents. Each agent has real, exploitable weak points.
No prior AI security experience is required. Attendees who bring a laptop with Docker leave with a working local install, and Verma covers how to deploy it for team training.
Abhinav Verma is a Senior Staff Security Engineer at Intuit with more than 15 years across AI, offensive, product and operations security. He leads AI reviews, penetration testing, threat modeling and vulnerability management for cloud platforms that run AI.
He leads the Agentic AI Goat project as well as DVAIA. He has presented at RSAC, DEF CON and BSides. His certifications include OSEP, OSCP and GWAPT.
He co-leads NightFalcon, an open-source security harness that Intuit's cybersecurity team built with OpenAI's cybersecurity team. It runs a nine-phase adversarial code review inside Claude Code, Codex or Cursor, then outputs proof-of-concept scripts, SARIF files and CVSS v4.0 scores.
NightFalcon maps its findings to the OWASP Top 10 lists for LLMs, agentic applications and MCP. The same three lists define the vulnerability families in the Goat.
To go deeper on the topic, start here:
- NightFalcon on GitHub (Intuit, co-led by Abhinav Verma)
- OWASP MCP Top 10
- OWASP GenAI LLM Top 10 2026
- OWASP Top 10 for Agentic Applications for 2026
AppSec engineers who have read about agent attacks but never run one will get a safe system to practice on.
Where does your team practice attacking AI agents before testing the ones in production?
1 point · 1 comment
Mentions
@RoryTyer It's literally useless. Claude connected to QBO (via this MCP - intuit/quickbooks-online-mcp-server) is my bookkeeper at this point.
Hacking 17 LLM Agents and 66 Planted Vulnerabilities in OWASP Agentic AI Goat: Abhinav Verma at Global AppSec USA 2026 OWASP Agentic AI Goat is a deliberately vulnerable platform with 17 LLM-powered agents, which hides 66 intentional vulnerabilities spanning the OWASP LLM, MCP and Web Top 10 lists. Deliberately vulnerable apps such as WebGoat give people a safe target to practice attacks on. Agentic AI Goat applies that idea to multi-agent AI systems, with MCP tool calling and RAG pipelines in the mix. RAG, or retrieval-augmented generation, feeds documents into a model's context at answer time. MCP lets agents call outside tools. In his Global AppSec USA 2026 demo lab, "OWASP Agentic AI Goat: Hands-On Hacking of Multi-Agent LLM Systems", on Thursday, November 5 at 1:15 p.m. in Golden Gate, Abhinav Verma lets attendees attack a multi-agent AI system live. Speaker: Abhinav Verma, Senior Staff Security Engineer, Intuit Visitors can try prompt injection, RAG poisoning, MCP tool poisoning, privilege escalation through agent chaining and supply chain remote code execution. A 10-level CTF has players extract secrets from AI guardians that get harder at each level. Their defenses adapt by learning the techniques attackers use against them. The platform also includes SecureShop v2, an e-commerce app run by 3 supervisor agents and 17 task agents. Each agent has real, exploitable weak points. No prior AI security experience is required. Attendees who bring a laptop with Docker leave with a working local install, and Verma covers how to deploy it for team training. Abhinav Verma is a Senior Staff Security Engineer at Intuit with more than 15 years across AI, offensive, product and operations security. He leads AI reviews, penetration testing, threat modeling and vulnerability management for cloud platforms that run AI. He leads the Agentic AI Goat project as well as DVAIA. He has presented at RSAC, DEF CON and BSides. His certifications include OSEP, OSCP and GWAPT. He co-leads NightFalcon, an open-source security harness that Intuit's cybersecurity team built with OpenAI's cybersecurity team. It runs a nine-phase adversarial code review inside Claude Code, Codex or Cursor, then outputs proof-of-concept scripts, SARIF files and CVSS v4.0 scores. NightFalcon maps its findings to the OWASP Top 10 lists for LLMs, agentic applications and MCP. The same three lists define the vulnerability families in the Goat. To go deeper on the topic, start here: - NightFalcon on GitHub (Intuit, co-led by Abhinav Verma) - OWASP MCP Top 10 - OWASP GenAI LLM Top 10 2026 - OWASP Top 10 for Agentic Applications for 2026 AppSec engineers who have read about agent attacks but never run one will get a safe system to practice on. Where does your team practice attacking AI agents before testing the ones in production?
@iShong_Pong لو عايزه تربطيه مع اي ايجنت غير كلود كود في عندك mcp intuit/quickbooks-online-mcp-server او انك تستخدمي api الرسمي وتخلي الai يكتب ليكي كود خاص بيكي يخليكي تنادمي علي المعلومه اللي عايزها بس وتبعتها للموديل مع نفسك وغالبا دا اللي هيمشي معاكي (ودا الاحسن) developer.intuit.com