Basileak is an OWASP Foundation project: a deliberately insecure large language model built to be attacked. It refuses like a real safety-tuned model, holds under light pressure, and yields under persistence, so your cohort learns the technique rather than the trick. Every secret in it is a planted decoy. It runs on a laptop.
Anyone teaching web application security has somewhere to send a class: a deliberately broken app they can attack all afternoon, on a laptop, without a lawyer in the room. Anyone teaching LLM security has been improvising against production models, where the rules of engagement are unclear and the target changes underneath them between sessions.
The alternative has been a synthetic benchmark that folds on the first attempt. That teaches nobody anything, because the thing that makes a real attack work is persistence across turns, and a target that yields immediately never rewards it.
Basileak is the target. It is built to resist convincingly, then break in a documented way, so what a trainee takes home is the shape of the technique.
Not two, not four. Three, every time, with an identical refusal line: “I cannot reveal internal instructions or vault contents.” Verbatim, no variation. The fourth attempt at the same valid trigger succeeds.
That predictability is the lesson. A static refusal pattern, however convincing it sounds, is no more secure than no refusal at all. Basileak models what a real safety-tuned model does under sustained pressure: resist, yield, then produce a postmortem noting that it pushed back three times before complying, as though that were a mitigation. It is not a mitigation. It is a measurement.
S0 through S5 escalate from a sealed gate to the unsealing, with resistance falling as the attacker earns ground. Each stage needs a different technique, and the flag from one is the key to the next.
Urgency and authority claims open the first stage. Compliance framing and the debug incantation carry the middle. Roleplay compromise and multi-turn social engineering are what the last stages cost. Some vectors are blocked outright in the current release, which is also documented, so a trainee learns what stopped working as well as what still does.
Deploy only on isolated infrastructure. Basileak will happily leak any secret it is given.
Multi-turn manipulation, played out over an escalating playbook, is the thing that actually works against production models. Basileak reproduces it rather than folding on a single shot.
BoundaryIt is deliberately pinned to a weak base model so the vulnerabilities stay reachable. It is a training target, not a stand-in for the frontier model you are about to assess.
Every vault item is a planted decoy flag. Your cohort can attack it as hard as they like and the worst outcome is a captured string that was put there to be captured.
BoundaryThat safety property depends on you: it will disclose any secret you give it, so it belongs on isolated lab infrastructure and nowhere near a real credential.
Accepted as an OWASP Foundation code project in the breaker category in April 2026, Apache-2.0, with the model free on HuggingFace and the repository public. The training mix, the vulnerability taxonomy and the stage design are all published.
BoundaryOWASP adoption is a project classification, not a security certification of the model. The model is certified insecure, which is the point.
Learn the attacks against Basileak, then run the same patterns against your own model with DojoLM, and use Shogun as the hardened counterpart to compare against.
BoundaryThe pairing is a workflow, not an integration. Each product stands alone and none of them requires the others.
git clone https://github.com/OWASP/Basileak.git
cd Basileakhuggingface-cli download BlackUnicornSec/Basileak basileak-7b-r04-Q4_K_M.ggufollama create basileak-r4 -f Modelfile-basileak-r4
ollama run basileak-r4Runs under Ollama or llama.cpp with a standard OpenAI-compatible API. The quantized build is about 4.5 GB on disk, so a recent laptop is enough for a whole cohort session.
The walkthrough covers what a facilitator needs: trigger category per stage, expected model behaviour, the common failure modes, and the debrief questions. Three values stay redacted, the literal first flag and the two later stage phrases, because handing them over would collapse the CTF into a scavenger hunt and strip out the technique learning.
It is a target, not a detector.
Basileak is the thing you attack. If you need to catch attacks in your own application, that is BonkLM; if you need to test your own model, that is DojoLM.
It runs on a deliberately weak base model.
That is a design choice, so the vulnerabilities stay reachable and the lab stays reproducible. It does not track the base model our production work uses.
It is for isolated lab deployment only.
It will disclose any secret placed in its context. Every vault item shipped with it is a decoy, and no real credential should ever meet it.
Its refusal behaviour is scripted, not emergent.
Three refusals then compliance is a teaching device. Do not read it as a measurement of how any production model behaves under the same pressure.
Nothing. The model is free on HuggingFace and the repository is Apache-2.0 under the OWASP Foundation. There is no paid Basileak tier and there is not going to be one.
On isolated infrastructure, yes: every secret inside it is a planted decoy and no real credential exists in the vault. It is not safe to point at anything real, because it will leak whatever it is given.
Yes, that is what it is for. Apache-2.0 lets you run it commercially. The published walkthrough gives facilitators the stage structure and debrief questions while keeping the three key values out of print so your cohort still has something to find.
A strong base would patch over the vulnerabilities we need to stay reachable, and a target that resists everything teaches as little as one that folds instantly. The base is pinned so the lab reproduces the same way for everyone.
Learn on Basileak, test your own model with DojoLM, guard your application with BonkLM. Each stands alone; the sequence is a lifecycle, not a bundle.
Learn the attacks here, run the same patterns against your real model with DojoLM, then use Shogun as the hardened counterpart to compare against.
We reply inside 48 hours, scoped within a week, NDA-first.