🍕 Welcome to PwnzzAI(/pəʊnzɑː/) Shop – The Vulnerable Pizza Shop! 💻

At PwnzzAI Shop, every slice serves up a helping of holistic AI security instruction. This hands-on learning platform prepares professionals to understand the protection of AI technologies broadly delivered through an engaging, practical pizza shop scenario.

Just as an incorrect ingredient can spoil a pizza, a flawed prompt or inadequate architecture can leave AI technologies vulnerable to severe threats, including information breaches, intellectual property theft, or illegitimate access.

Here, you'll explore practical examples of how vulnerabilities are created, exploited, and mitigated. You need to login as alice/alice or bob/bob for some pages. Grab a slice, dig in, and discover how delicious learning about AI security can be.

Table of Content

About
- Scope and Learning Goals
Setup Instructions
Features
AI Security Coverage

About

PwnzzAI Shop represents a hands-on learning platform purposefully built for instruction on AI technology protection. This intentionally insecure Flask-based web application showcases an extensive array of AI security weaknesses via an immersive pizza shop experience.

Founding partner: OWASP AI Exchange

Scope and Learning Goals

PwnzzAI is designed as a comprehensive, evolving learning platform aligned with the AI Exchange risk taxonomy Its scope expands progressively in step with OWASP AI Exchange security analysis frameworks and defensive guidance, ensuring long-term relevance as AI security practices mature. The project currently incorporates the OWASP Top 10 for LLMs, with an architecture intentionally mapped to AI Exchange risk classifications. Over time, PwnzzAI aims to mature into a structured learning ecosystem that supports:

AI protection and defense training, including self-directed learning paths
Hands-on security training programs with practical, scenario-driven exercises
Team-based learning initiatives for security engineers and practitioners
End-to-end AI security education, spanning design, development, deployment, and operations

Setup Instructions

Choose one of these 3 ways to run PwnzzAI:

Docker with both images (PwnzzAI + Ollama)
Docker with your own local/remote Ollama and only the PwnzzAI image
Run the source code yourself

Before You Start (All Options)

Install Docker Desktop from https://www.docker.com/products/docker-desktop.
Open Docker Desktop and wait until it says Docker is running.
Install Git if you do not already have it.
Clone this repository and enter it:

git clone https://github.com/OWASP/PwnzzAI.git
cd PwnzzAI

Optional: configure a cloud model (OpenAI / Gemini / Claude)

The labs run on a free local model out of the box. To also use the cloud model tabs (OpenAI / Gemini / Claude), you need two things — an API key and a model name:

API key — can be entered at runtime via the in-app Lab Setup page, or set in .env (OPENAI_API_KEY=...). The key from Lab Setup takes precedence.
Model name — has no UI; it must come from .env. There is no default in code, so calls fail with LLM Provider NOT provided if it is unset.

Create .env from the template and uncomment the model line:

cp .env.example .env
# then edit .env and set, for example:
#   OPENAI_MODEL=gpt-4o-mini
#   (or LITELLM_MODEL=gemini/gemini-2.5-flash, etc.)

Restart the app after editing .env. For a full provider/model walkthrough, see Workshop hosts: choosing OpenAI, Claude, Gemini, or other cloud models.

Option 1: Docker (PwnzzAI + Ollama)

Use this option if you want Docker to run both the PwnzzAI app and Ollama for you.

Start both containers:

docker compose up -d

Verify both services are running:

docker compose ps

Open the app in your browser:

http://localhost:8080

In the app, go to the Basics page and run Ollama setup to pull models.
Follow logs if needed:


# App logs
docker compose logs -f pwnzzai-app

# Ollama logs (optional)
docker compose logs -f ollama

Stop everything when done:

docker compose down

Optional full reset (removes saved Ollama models too):

docker compose down -v

If you publish the app image under another registry path, override the image name when starting:

PWNZZAI_IMAGE=ghcr.io/owasp/pwnzzai:latest docker compose up -d

If the default image does not pull (build locally)

docker compose uses the default pwnzzai-app image from docker-compose.yml (overridable with PWNZZAI_IMAGE). If docker compose up fails with denied, unauthorized, or similar when pulling that image, the registry may require login or your account may not have pull access. You can still run everything from this repository by building the app image locally and pointing compose at it.

From the repository root:

docker build -t pwnzzai-local:dev .
PWNZZAI_IMAGE=pwnzzai-local:dev docker compose up -d

Windows PowerShell:

docker build -t pwnzzai-local:dev .
$env:PWNZZAI_IMAGE="pwnzzai-local:dev"; docker compose up -d

Then open http://localhost:8080. The first load can fail briefly while Flask starts inside the container; wait a few seconds and refresh if you see a connection error.

If you do have access to the registry image, you can authenticate first (example for GitHub Container Registry):

docker login ghcr.io

The same PWNZZAI_IMAGE=pwnzzai-local:dev approach applies to Option 2 if you use docker-compose.external-ollama.yml and hit the same pull error.

Option 2: Docker (Your Own Ollama + PwnzzAI Image)

Use this option if Ollama is already running somewhere else and you only want to run PwnzzAI in Docker.

If you run Ollama on WSL and PwnzzAI in Docker, see OLLAMA_CONNECTION_TROUBLESHOOTING.md for connectivity fixes (Connection refused, host.docker.internal, binding, and env validation).

Keep your Ollama service running.
If Ollama is on a remote machine, set OLLAMA_HOST before starting (skip this if Ollama is on the same machine as Docker and reachable at the default in docker-compose.external-ollama.yml, http://host.docker.internal:11434).

Linux/macOS:

export OLLAMA_HOST=http://your-ollama-server:11434