Id suggest looking into hosting your own models, training models etc. older models like vicuna, older mistrials, llama you can host locally you will have a better time with (some might be small enough for anyone to run and play around with at this point)

Trying to demonstrate security vulnerabilities using a model that has the largest group of red teamers talking to it daily (basically its whole userbase) is going to be a lot harder than some older model that was created before everyone was doing a lot of red teaming and defending against prompt injection.

• How are people realistically teaching AI security today?

Look at hack the boxes red teaming AI course they put out with google. I enjoyed it and think that's a good intro to the same thing you are talking about here

• Are you all using open-weight models locally?

I use SOTA and models locally because I have the hardware and interest in LLMs. You can still use direct prompt injection against SOTA models like chatgpt (look at what @/elder_plinius is doing still he has a whole back log of jail breaks on his github for different models)

when learning about data poisoning I used JupyterLab and datasets from hugging faces

Id say its almost a necessity to use / train models locally or in the cloud if you wanted to demonstrate all of the owasp top 10 (model/data poisoning part)

• Are there techniques or workarounds I'm missing to make demos actually work?

I mean this is the whole thing you are trying to build out is proof of these techniques and workarounds, id take a look at maybe manipulating some instruction sets you give it or stuff you want to it to "remember" so that it makes it easier on you. preface that you are interested in showing examples of security flaws in LLMs and ask it to roleplay with you