MIRAGE trains browser security and AI agent attack risks
MIRAGE is a web security training track with levels 0 through 40, and every level runs inside the browser. It does not require a separate remote shell, , or security testing .
The track covers , unsafe trust in browser-side checks, broken , IDOR, BOLA, and RLS mistakes in services like Firebase and Supabase. It also covers login systems, JWT, token abuse, SQLi, NoSQLi, SSTI, , XSS, SSRF, insecure deserialization, and GraphQL weaknesses.
The final section moves into AI and attacks, including , stored malicious instructions, unsafe output handling through markdown-image leaks, confused-deputy tool abuse from agents with too much freedom, and vector-store BOLA. The lessons are tied to real 2025 and 2026 CVEs and incidents, including an indirect injection pattern similar to EchoLeak.
Key points
- The training has 41 browser-based levels, from L0 to L40.
- It covers common web app risks such as failures, token abuse, GraphQL issues, and injection attacks.
- The AI section includes , stored malicious instructions, unsafe outputs, and tool abuse.
- It is relevant for AI agents because agents often connect models to browsers, databases, and external tools.
- The material is anchored to real 2025 and 2026 and incidents.