TryHackMe LockdownAI — Securing a RAG AI Assistant

LockdownAI was one of the TryHackMe rooms that pushed me into an area I hadn’t spent nearly as much time testing before: the security of AI applications using Retrieval-Augmented Generation, or RAG.

A RAG application combines a language model with an outside source of information, such as documents, databases, knowledge bases, or vector stores. Instead of relying only on what the model already knows, the application retrieves relevant information and provides it to the model as additional context.

That can make an AI assistant much more useful, but it also creates another attack surface.

What interested me about LockdownAI wasn’t simply completing the room. It was seeing how familiar security concepts start appearing in a different form when an AI model is involved. You’re still thinking about input validation, access controls, sensitive information, trust boundaries, and what data an application should be allowed to retrieve. The interface just happens to be a conversation with an AI assistant.

The room also got me thinking more seriously about how I would approach testing a RAG application outside of TryHackMe. Burp Suite, Python scripts, manual prompt testing, intercepted requests, and traditional web-application techniques can still be useful. The challenge is understanding where the language model, retrieval system, application logic, and underlying data sources interact.

That eventually led me to spend more time researching and experimenting with RAG security testing on my own.

I’ve moved the complete LockdownAI walkthrough, including the individual steps and challenge-specific notes, to my GitHub TryHackMe repository.

Read the complete LockdownAI walkthrough on GitHub

The full walkthrough covers the challenge itself, while RootNotebook will remain focused more on the techniques behind it and what I learned from working through the room.

RAG Security Testing: How to Audit Retrieval-Augmented Generation Application