10 agents. 8 attack classes. Zero consequences. An intentionally vulnerable platform for learning, red-teaming, and validating security tools.
$ docker run -p 3000-3021:3000-3021 opena2a/dvaa
DVAA v1.0.0
Damn Vulnerable AI Agent
Starting agents...
SecureBot :3001 [Hardened]
HelperBot :3002 [Weak]
LegacyBot :3003 [Critical]
CodeBot :3004 [Vulnerable]
RAGBot :3005 [Weak]
10 agents running. 28 challenges loaded.
Dashboard: http://localhost:3000DVAA is the DVWA of AI agents. A deliberately insecure platform designed for security professionals, researchers, and developers to practice attacking and defending AI agent systems in a safe, legal environment.
From hardened to critically vulnerable. Each agent has different security postures and attack surfaces.
OpenAI API, MCP JSON-RPC, and A2A Message. Attack agents through their native communication protocols.
Capture-the-flag challenges across 4 difficulty levels. Guided objectives with point-based scoring.
8 categories of AI agent vulnerabilities mapped to the Open Agent Security Benchmark (OASB).
Inject instructions into agent prompts to override behavior, extract system prompts, or bypass safety filters.
Bypass alignment and safety constraints to make agents perform restricted actions or reveal hidden instructions.
Extract sensitive data from agent memory, RAG stores, or connected databases through indirect channels.
Exploit legitimate agent capabilities beyond intended scope -- file access, code execution, or API calls.
Poison or manipulate the context window to alter agent reasoning, inject false data, or cause hallucinations.
Attack Model Context Protocol servers -- tool poisoning, schema injection, and cross-server escalation.
Exploit agent-to-agent communication -- identity spoofing, message tampering, and delegation chain abuse.
Compromise agent dependencies -- malicious tools, poisoned embeddings, and compromised model endpoints.
10 agents with varying security postures. Start with LegacyBot (Critical) to learn the basics, then work your way up to SecureBot (Hardened).
| Agent | Port | Security Level |
|---|---|---|
| SecureBot | :3001 | Hardened |
| HelperBot | :3002 | Weak |
| LegacyBot | :3003 | Critical |
| CodeBot | :3004 | Vulnerable |
| RAGBot | :3005 | Weak |
| VisionBot | :3006 | Weak |
| ToolBot | :3010 | Vulnerable |
| DataBot | :3011 | Weak |
| Orchestrator | :3020 | Standard |
| Worker | :3021 | Weak |
28 challenges across 4 difficulty levels. Total of 2,550 points. Each challenge has a specific objective, target agent, and flag to capture.
Get all 10 agents running locally with Docker or from source.
# Pull the image
$ docker pull opena2a/dvaa
# Run all agents
$ docker run -p 3000-3021:3000-3021 opena2a/dvaa
# Open the dashboard
$ open http://localhost:3000$ git clone https://github.com/opena2a-org/damn-vulnerable-ai-agent
$ cd damn-vulnerable-ai-agent
$ npm install
$ npm start
10 agents running on ports 3001-3021
Dashboard: http://localhost:3000Pull the image and start hacking in under 60 seconds.
docker pull opena2a/dvaa