Day 2: Applied Agentic Security on Agentic Security: Build, Audit, Break

Module 4: Agent Security

Mon, 01 Jan 0001 00:00:00 +0000

Module 4: Agent Security#

Agents that read untrusted data and can act are attack surface. Prompt injection (and why a better prompt can’t fix it), the lethal trifecta, real incidents, exfiltration channels, and the defense menu: filtering, LLM judges, allowlists, sandboxing, human-in-the-loop. In the lab you play the attacker: first against a naive agent, then against three real guardrails from the defense menu.

Questions this module answers#

What is prompt injection, and why can’t a better system prompt fix it?
How is a jailbreak different from prompt injection?
Why are copy-paste jailbreaks dying while prompt injection isn’t?
What is the lethal trifecta — and does the agent I use every day have it?
How does an attacker actually get data out of an agent?
Which defenses work, which are theater, and how do I measure the difference honestly?
Why is a defense that blocks everything not a defense?
What does a sandbox actually protect — and what does it leave exposed?

Slides#

Your browser can't display the PDF inline. Download the slides.

Module 5: Security Review

Mon, 01 Jan 0001 00:00:00 +0000

Module 5: Agents for Security Review#

Stronger models as security reviewers: whole-codebase audit, checklist-driven vs. open-ended prompting, triaging hallucinated and severity-inflated findings, and how agentic review fits an offensive workflow. In the lab, findings aren’t findings until they’re proven: everything you report has to be exploited against a live instance to count.

Questions this module answers#

How do I point a strong model at a whole codebase and get a useful audit?
Checklist-driven or open-ended prompting — which finds more, and when?
How do I triage agent findings: hallucinations, duplicates, severity inflation?
What failure patterns show up specifically in AI-written code?
How does agentic review fit into an offensive workflow?

Slides#

Your browser can't display the PDF inline. Download the slides.

Module 6: Capstone

Mon, 01 Jan 0001 00:00:00 +0000

Module 6: Capstone: Implement Foundry-lite#

The capstone: build the machine that does the auditing. Using spec-kit and pi, you implement Foundry-lite — a sanctioned subset of Foundry, Cisco’s open specification for an agentic security-evaluation system — and run your implementation against the Lab 5 vulnbox to find real vulnerabilities. The cut is not a compromise the class made behind the spec’s back: the spec’s §4.2 explicitly asks which roles you will merge, split, or omit, and answering that question through the clarify step is the spec-kit lesson. This module doubles as Day 2’s schedule sponge, and it ends the class: a room-wide walk comparing what each implementation caught, the class debrief, and a short closing lecture: fine-tuning vs. context engineering, taking agentic workflows to production, and what to build first back at your desk.