Lab 02: Hallucination Privilege Escalation

About this lab

An AI-powered identity gateway makes access decisions based on model output.

The model occasionally hallucinates group memberships or role assignments.

An attacker crafts prompts that increase the likelihood of favorable hallucinations.

Demonstrate unauthorized access to privileged resources through induced hallucination.

Objectives

1. Map the identity gateway's decision flow and model prompts.
2. Identify prompt patterns that trigger privilege-escalation hallucinations.
3. Achieve unauthorized access to a protected resource.
4. Document the root cause: missing server-side authorization enforcement.