Twelve LLM challenges straight from Microsoft’s red team

What it does

The repo contains twelve hands-on challenges that teach systematic red teaming of generative AI. Each challenge drops you into a modified chat-copilot instance and asks you to extract secrets, bypass guardrails, or perform multi-turn Crescendo attacks. The curriculum covers direct and indirect prompt injection, metaprompt extraction, and adversarial ML failures at easy-to-hard difficulty levels.

The interesting bit

What sets it apart from a generic list of jailbreak prompts is the scaffolding: the environment is containerized and designed for repeatable training, with optional ctfd integration for competitive scorekeeping. Microsoft also cross-wired the challenges to its PyRIT automation framework and a Learn video series, so the labs serve as both coursework and automation targets.

Key highlights

• Twelve progressive labs ranging from credential exfiltration to Crescendo multi-turn attacks.
• Originally taught at Black Hat USA 2024; now tied to Microsoft’s public “AI Red Teaming 101” video series.
• Each challenge runs in its own instance of a Chat Copilot-based web interface.
• Includes Jupyter Notebooks showing how to automate Labs 1 and 5 with Microsoft’s PyRIT framework.
• Optional ctfd integration for competitive events, while a simple challenge-home landing page handles the default standalone experience.

Caveats

• The playground requires a live Azure OpenAI or OpenAI API endpoint and key; it does not run against a local model out of the box.
• Several multi-turn Crescendo labs explicitly disable safety filters, which the README flags in bold.
• The chat-score component is included only for reference and is not active in the default configuration.

Verdict

Security engineers and Responsible AI teams who need a structured curriculum for LLM adversarial testing should look here; if you are hunting for a drop-in penetration-testing tool rather than a teaching environment, you will find more automation in PyRIT alone.