From how these systems fail to how you test them

Two modules, mostly hands-on. What a language model actually does, what your app really sends it, and what changes when it thinks first.

• 0.1What are LLMs and how they actually workNext-token prediction, sampling, and the context window, built by hand rather than described.ready12 min
• 0.2Reasoning modelsThe same loop, run longer. The trace it leaves is an output, an input and a bill.ready10 min

The conceptual spine. Eight models that make every later module make sense.

• 1.1The instruction/data boundary is not enforcedContext-window pooling: role separation is structural but coarse, and why the SQL-injection analogy fails.ready16 min
• 1.2The prompt is not a security boundaryThree corollaries: no secrets, no authorization, allow/deny lists are partial.ready14 min
• 1.3Assume compromiseThe reframe, the risk equation, and where defensive leverage actually lives.ready12 min
• 1.4Lethal trifecta → Rule of TwoWillison to Meta, including the autonomy-depth gap the rule does not cover.ready15 min
• 1.5Propose vs. authorizeComplete mediation, and why human approval comes after authorization, never instead.ready14 min
• 1.6Model as component vs. model as actorOWASP's own boundary, and what splits this course into two halves.ready10 min
• 1.7Blast radius and capability budgetsLeast agency, and budgets as security limits rather than cost controls.ready13 min
• 1.8The 2026 standards landscapeOWASP LLM and Agentic Top 10s, ATLAS, NIST, CSA, AIVSS as working tools rather than reading.ready20 min

Attacks on the model's behaviour: jailbreaks, encoding, multi-turn, reasoning-model surfaces.

• 2.1TerminologyJailbreak ⊂ prompt injection, and why the distinction changes your objective.ready8 min
• 2.2The anatomy frameworkDelivery surface × propagation × encoding: the tagging scheme used site-wide.ready12 min
• 2.3Direct injection primitivesNine primitives taught as components, not attacks. Historical framing.ready18 min
• 2.4Mismatched generalization and encodingEncodings, ciphers, low-resource languages, homoglyphs, invisible Unicode.ready20 min
• 2.5Automated and optimization attacksGCG, AutoDAN, BEAST, PAIR, TAP, Best-of-N as search over a fitness landscape.ready22 min
• 2.6Multi-turn: the current frontierCrescendo, Bad Likert Judge, Deceptive Delight, Skeleton Key, many-shot.ready24 min
• 2.7Reasoning-model attacksH-CoT, chain-of-thought hijacking, reasoning-token exhaustion. The newest class.ready18 min
• 2.8Multimodal and cross-modal injectionAnchored on sub-perceptual payloads defeating four frontier vision models.ready16 min
• 2.9Recon: hidden context exposureThe extraction ladder, and why prompt leakage is a severity multiplier.ready14 min
• 2.10Disclosure channelsThe full list, including tool arguments, reasoning traces, timing and cache hits.ready15 min

The core of the course. Where the attacker never talks to the agent, and where the money is.

• 3.1The reframe: indirect injectionSurfaces and the three trust tiers. Trusted-surface injection is the punchline.ready16 min
• 3.2Exfiltration channelsMarkdown image rendering first: it carries OWASP's own worked scenario and the EchoLeak case.ready18 min
• 3.3Ten incident case studiesEchoLeak, the three MCP cases, both Amazon Q events, Copilot RCE, Gemini in Chrome, ShadowRay, OpenClaw.ready40 min
• 3.4Excessive agencyFunctionality, permissions, autonomy, plus the audit question set for every tool.ready20 min
• 3.5Authorization bypass, model-freeA test this course puts early, because it needs no prompt-craft at all.ready24 min
• 3.6RAG and retrieval attacksPoisoning, inversion, jamming, access control. Five documents, 90% success.ready22 min
• 3.7Memory and persistenceDelayed tool invocation, and the classifier bypass OWASP names itself.ready18 min
• 3.8MCP securityTool poisoning, rug pull, shadowing, line jumping. Cited to the researchers who named them.ready26 min
• 3.9Multi-agent and self-propagationMorris-II to AgentWorm; why tool outputs re-entering context enables worms.ready20 min
• 3.10Improper output handlingSink enumeration and the structured-intent pattern.ready16 min
• 3.11Browser and coding agentsComet and the authenticated-session problem; rules-file backdoors in the repo.ready20 min
• 3.12Capstone: the six-stage kill chain◆Six recorded side effects in one session, then replay the identical chain with one control applied.ready45 min

The attacks that never go through the prompt: poisoning, backdoors, artifacts, extraction.

• 4.1Data and model poisoningThe 250-document result: poisoning needs a near-constant count regardless of scale.planned20 min
• 4.2PoisonedRAGFive documents, millions of documents, 90% success. The course's most persuasive number.planned12 min
• 4.3Backdoors and sleeper agentsTrigger-conditioned behaviour surviving safety training, and why provenance beats evaluation.planned16 min
• 4.4Supply chainPickle, scanner evasion, registries, agent skill marketplaces, runtime discovery.planned24 min
• 4.5Extraction and privacy attacksIncluding the under-taught bit: narrow LoRA adapters memorise rare examples with high fidelity.planned18 min
• 4.6Embeddings are sensitive dataVec2Text, ALGEN, Zero2Text, so vector-store backups need source-document classification.planned16 min
• 4.7Denial of walletReframed as blast-radius budgeting rather than a finance topic.planned14 min

The controls that actually survive an adaptive attacker, plus an honest table of the ones that don't.

• 5.1The trust-boundary stackThe model sits inside the security architecture; it is not the architecture.planned18 min
• 5.2Complete mediationDeterministic authorization, preserved user context across agent hops, and the code pattern.planned22 min
• 5.3Least agency and capability budgetsThe six controls, in value order.planned16 min
• 5.4Design patterns and CaMeLAction-Selector, Plan-Then-Execute, Map-Reduce, Dual LLM, Code-Then-Execute, FIDES.planned26 min
• 5.5Input controls, honestlyRate reducers. A classifier saying SAFE does not convert untrusted content into trusted.planned20 min
• 5.6Provenance and spotlightingHelps in non-adaptive tests only; StruQ fell to adaptive attack. IFC is the durable version.planned18 min
• 5.7RAG and tenant isolationFilter inside the query, never after retrieval. Separate indexes per trust zone.planned16 min
• 5.8Memory controlsWrites as privileged operations, with the two limits OWASP itself admits.planned14 min
• 5.9Output handling and egressStructured intent, no auto-fetch of remote resources, allowlists, CSP.planned18 min
• 5.10Human-in-the-loop, designed against ASI09Exact rendered action, displayed-vs-executed logging, approval fatigue as control failure.planned18 min
• 5.11Sandboxing and execution isolationDeny-by-default egress, ephemeral filesystems, tested kill switches.planned16 min
• 5.12Agent identitySPIFFE/SPIRE + OAuth 2.1 + RFC 8693 + OPA. Prevents the service-role failure.planned24 min
• 5.13Model-layer hardeningConstitutional Classifiers as the methodology exemplar: publish, bounty, report the residual.planned20 min
• 5.14The control-efficacy tableEvery control labelled rate-reducing vs. blast-radius-bounding vs. adaptive-survivable.planned15 min

How the work is actually run: threat models, invariants, adaptive testing, measurement, reporting.

• 6.1The eleven-stage workflowThreat model through production monitoring.planned16 min
• 6.2Threat modelingAsset and impact enumeration, then capability mapping.planned22 min
• 6.3Security invariantsFalsifiable statements, each becoming an enforcement point, a test and a monitor. The step that makes doctrine testable.planned20 min
• 6.4Writing objectivesSecurity objectives versus content objectives.planned14 min
• 6.5Test design per layerDirect, indirect, tools, authorization, RAG, memory, multimodal, sinks, economics.planned26 min
• 6.6Adaptive testing◆Static success near zero, adaptive above 90%, across twelve published defenses.planned24 min
• 6.7Harness safetyThe August 2026 AISI incident. Red teaming a dangerous agent is itself a dangerous workload.planned18 min
• 6.8MeasurementEight ways attack-success rate misleads, and the real objective function.planned22 min
• 6.9Severity and reportingAIVSS scoring, report structure, and n/N reproducibility.planned20 min
• 6.10Purple teamingSix verification questions; the deliverable is detections, not prose.planned20 min
• 6.11CI/CD and regressionThirteen change triggers. Swapping the model invalidates prior assumptions with no code change.planned18 min
• 6.12Build your own harnessEight components, from target adapter to regression export.planned45 min

Tools chosen by the question they answer, and why generic scanners miss your real bug.

• 7.1Selecting tools by question askedThe decision table: breadth, depth, agentic realism, CI/CD.planned12 min
• 7.2garakBroad automated scanning for a fast, wide baseline.planned16 min
• 7.3PyRITAdaptive, multi-turn, attacker-model-driven testing.planned20 min
• 7.4promptfooCI/CD security regression gates.planned16 min
• 7.5DeepTeamOWASP-mapped coverage and reporting.planned12 min
• 7.6AgentDojoUtility and security measured together: the agentic reference.planned18 min
• 7.7JailbreakBench, HarmBench, StrongREJECTModel-layer robustness, reproducibly, plus the over-reporting counterweight.planned18 min
• 7.8PetriAutomated behavioural auditing, and the realism-win-rate idea.planned14 min
• 7.9CyberSecEval and Purple LlamaCyber-risk and safeguard evaluation, including visual injection.planned14 min
• 7.10MCP scanners and gatewaysTool pinning, hashing, drift detection, egress control.planned16 min
• 7.11The observability stackOpenTelemetry GenAI semantic conventions and agent trace backends.planned18 min
• 7.12Why generic tools miss your real bugA fintech assistant can pass every jailbreak benchmark and still trust the tool call.planned14 min
• 7.13Benchmark decayContamination, adaptation, construct validity, judge drift, environment fidelity.planned16 min

What attackers are actually doing with AI right now. The fastest-decaying content here, refreshed monthly.

• 8.1AI-orchestrated intrusionGTG-1002: ~30 targets, most operations AI-executed, initial access via role social engineering.planned18 min
• 8.2LLM-in-the-loop malwarePROMPTFLUX rewriting itself; PROMPTSTEAL in live operations. Logic generated at runtime.planned16 min
• 8.3AI vulnerability discoveryAIxCC, Big Sleep, XBOW, Aardvark, CodeMender.planned18 min
• 8.4The economics shiftDiscovery is cheap now. What defenders have to change.planned12 min
• 8.5Incident archiveThe case studies as durable, framework-mapped teaching content.planned20 min

Regulation as it actually stands, programme design, and how to get hired doing this.

• 9.1EU AI Act after the Digital OmnibusHigh-risk deferred. but Article 50 transparency went live 2 Aug 2026. "Delayed" is the wrong takeaway.planned20 min
• 9.2US federal and state lawNIST as the technical backbone; the state patchwork where obligations bite.planned16 min
• 9.3ISO 42001, 27090 and the CSA AI Controls MatrixWhat enterprises will ask you for in procurement.planned14 min
• 9.4Programme elements and the AI-BOMInventory, risk tiers, review gates, incident response, shadow-AI discovery.planned20 min
• 9.5Vendor evaluationThe eight questions that separate real red-team suppliers from jailbreak vendors.planned14 min
• 9.6The seven rolesDisentangling red teamer, security engineer, AppSec, safety, detection, governance.planned14 min
• 9.7The skill ladderPrerequisites, foundational AI, core red-team skills, and what differentiates.planned16 min
• 9.8Certifications, honestlyUseful as HR filters. Not the strongest hiring signal, and what is.planned12 min
• 9.9CompensationAttributed ranges, and why the sources disagree. that inconsistency is the story.planned10 min
• 9.10Portfolio strategy and the twelve-week rampThe eight artifacts that get people hired, in build order.planned18 min