Tool · curated 30 Sep 2026
GitHub - wattzgoat/wattzgoat-web: WattzGOAT is an intentionally vulnerable web application.
First reported github.com
Coverage timeline
Single-source analysis — first reported, latest, and curated coincide.
Why it matters
WattzGOAT gives defenders and red-teamers a runnable, intentionally vulnerable sandbox — including chatbot/assistant components — to practice exploiting and hardening AI-enabled web application weaknesses.
WattzGOAT (wattzgoat/wattzgoat-web) is an intentionally vulnerable web application published on GitHub as a training/lab environment, featuring a chatbot and 'pending-assistant-action' mechanics, per-flag and category hardening toggles, and a decoupled trainer dashboard. The repo appears designed as a deliberately-vulnerable playground for practicing exploitation and defense, including chatbot/assistant-related flaws.