LLM and Agentic AI Security

Get oriented before you start: why LLM and agent systems break the habits of traditional security work, how the course pairs every attack with the defense that answers it, what you should already know, and how the browser-based labs work.

See why the attack surface of a language model is the conversation rather than the code, and how jailbreaking, task hijacking, and token smuggling turn a model's helpfulness into a way past its system prompt.

Run an escalating jailbreak chain against a retail assistant, judge each of five attack techniques as a success or a block, and record what its system prompt actually constrained.

Work through the OWASP Top 10 for LLMs as a shared vocabulary for AI risk, and see why the model is one more piece of your attack surface rather than a replacement for network and access controls.

Probe a healthcare assistant for prompt injection, sensitive information disclosure, and excessive agency, then turn what comes back into a finding report with evidence, a justified severity, and a recommended fix.

Learn where indirect prompt injection comes from: payloads that wait inside the documents, web pages, and connectors your model reads to do its job, reaching it without an attacker ever touching your application.

Plant a hidden instruction in a webpage, watch a news summarizer carry it into its output, and identify which articles in a feed were poisoned from the evidence in the summaries alone.

See why a provider's safety layer knows nothing about your operational risks, where the firewall analogy breaks down for language models, and how layered guardrails sit around a hardened system prompt.

Harden a finance assistant's system prompt one rule at a time, then re-run the attacks to see exactly which rule closes which door without breaking ordinary customer questions.

Follow how RAG moves the primary attack surface from the user's prompt to the document store, and what data poisoning, over-permissive retrieval, and pipeline defenses look like in practice.

Watch a legal research assistant cite a precedent that never existed, test whether a guard prompt is enough to stop it, and decide what retrieval-time controls you would ship instead.

Examine why agent-to-agent handoffs are not microservice calls: text is the protocol and text can be argued with, so segregation of duties and secure communication have to be designed in.

Write role cards for a planner, a coder, and a reviewer, then build the validation function that enforces them so legitimate pipeline traffic passes and adversarial messages are blocked with an auditable reason.

Close the black box: why a successful API call can be the attack, what chain-of-thought logging has to capture, and how incident response playbooks change when the system acts at machine speed.

Instrument a booking agent with structured JSON Lines logging that captures enough to reconstruct any run, then execute a containment plan against it.

Work out where humans belong in an autonomous workflow: the speed gap between agent action and human detection, risk gates set by consequence rather than by task, and the oversight patterns that survive real use.

Build a deterministic risk gate that routes a procurement agent's purchase orders to approval, human review, or an outright block, with the reason attached to every decision.

Understand what changes when a model gets tools and write access, and how an unauthorized action rides along inside legitimate work while every dashboard stays green.

Send poisoned tickets through a support agent that reads and acts on a CRM, then write the classifier prompt that separates a customer describing a problem from a payload instructing the system.

See how unified reasoning across text, vision, and audio lets an instruction hidden in one modality steer the output of another, and why passive-data assumptions about images no longer hold.

Hide an instruction in a receipt image that a human reviewer cannot see, run it through an expense agent, and then make the tampering visible once it has landed.

Write instruction guardrails that hold: identity, scope, and behavioral constraints stated as prohibitions the model cannot read as optional, plus the tests that show whether they work.

Add three named rules to a tutoring assistant's system prompt so it stops completing student work, then test that legitimate questions still get answered.

Address the fact underneath every attack in this course: natural language cannot separate the control plane from the data plane, and XML-style tags create boundaries that prose instructions cannot.

Rebuild a moderation assistant's flat prompt template into tagged blocks that keep policy and user content apart, and test the result against embedded-instruction and format-mimicry attacks.