← All courses
Advanced · 7 lessons
AI agent security: from prompt injection to the OWASP LLM Top 10
A defensive course on agent security: why LLMs do not separate instructions from data, direct and indirect prompt injection, the lethal trifecta and exfiltration, sandboxing and least privilege, MCP and supply-chain security, red-teaming and incident response — grounded in the OWASP LLM Top 10 and public incident reports.
- 01Instruction-data confusion: the root of the vulnerabilityWhy an LLM fundamentally cannot tell an instruction from data, where this comes from in the model architecture, and why it makes a tool-using agent vulnerable by design.45 min
- 02Direct and indirect prompt injectionTwo classes of injection: direct from the user and indirect from data the agent reads itself — with real incidents and layered defense.50 min
- 03The lethal trifecta and exfiltration channelsThe Simon Willison model: private data + untrusted input + an outbound channel = leak. Learn to find and break at least one leg of the trifecta.55 min
- 04Sandboxing, permission scoping, and least-privilege toolsHow to limit what an agent can do at all: environment isolation, narrow tools, short-lived minimally scoped tokens, and human approval gates.50 min
- 05MCP server and supply-chain securityMCP extends an agent with third-party tools — and their attack surface: tool poisoning, rug pulls, malicious and typosquatted servers, and how to build chain trust.50 min
- 06Red-teaming your own agentA methodology for stress-testing your own agent: from a threat model to a corpus of adversarial tests, automation, and CI regressions — without ready-made exploits.55 min
- 07Monitoring and incident response for a fleet of agentsObservability of calls and outputs, anomaly detection and guardrails, a response and containment plan, and tying all defenses to the OWASP LLM Top 10.50 min