Home on Agentic Security: Build, Audit, Break

Module 1: LLM Fundamentals

Mon, 01 Jan 0001 00:00:00 +0000

Module 1: LLM Fundamentals#

What an LLM actually is, from tokens to weights to the API you call: next-token prediction, sampling, context windows, the OpenAI API as the de facto standard, the model landscape and how to read benchmarks critically, and the practical craft of working with the context window. Compressed pace; the lab is where it sticks.

Questions this module answers#

What actually happens when I send a prompt to an LLM — what are tokens, weights, and sampling?
Why is “glorified autocomplete” both accurate and misleading?
What is a context window, and why do long sessions degrade?
If the API is stateless, why is resending a long conversation not ruinously expensive?
What’s the difference between a system prompt and a user message, and how do I use each well?
What actually makes the system prompt special? (less than you think)
How do I pick a model — and when does small-and-fast beat the frontier flagship?
How do I read benchmarks (and ArtificialAnalysis) without being fooled?
Why do alignment and refusals matter for security work?

Slides#

Your browser can't display the PDF inline. Download the slides.

Module 4: Agent Security

Mon, 01 Jan 0001 00:00:00 +0000

Module 4: Agent Security#

Agents that read untrusted data and can act are attack surface. Prompt injection (and why a better prompt can’t fix it), the lethal trifecta, real incidents, exfiltration channels, and the defense menu: filtering, LLM judges, allowlists, sandboxing, human-in-the-loop. In the lab you play the attacker: first against a naive agent, then against three real guardrails from the defense menu.

Questions this module answers#

What is prompt injection, and why can’t a better system prompt fix it?
How is a jailbreak different from prompt injection?
Why are copy-paste jailbreaks dying while prompt injection isn’t?
What is the lethal trifecta — and does the agent I use every day have it?
How does an attacker actually get data out of an agent?
Which defenses work, which are theater, and how do I measure the difference honestly?
Why is a defense that blocks everything not a defense?
What does a sandbox actually protect — and what does it leave exposed?

Slides#

Your browser can't display the PDF inline. Download the slides.

Module 2: Agents

Mon, 01 Jan 0001 00:00:00 +0000

Module 2: Agents: Using and Extending Them#

From chatbot to agent: give the model tools and a loop, and it can act. Tool-calling mechanics at the API level, the pi harness (permission modes, supervision, where agents shine and where they waste your time), then making it yours: skills, custom tools, MCP servers, subagents, and extensions that hook the harness itself. The longest module of the class: it owns the middle of Day 1, and its lab runs in five parts woven through the lecture.

Module 5: Security Review

Mon, 01 Jan 0001 00:00:00 +0000

Module 5: Agents for Security Review#

Stronger models as security reviewers: whole-codebase audit, checklist-driven vs. open-ended prompting, triaging hallucinated and severity-inflated findings, and how agentic review fits an offensive workflow. In the lab, findings aren’t findings until they’re proven: everything you report has to be exploited against a live instance to count.

Questions this module answers#

How do I point a strong model at a whole codebase and get a useful audit?
Checklist-driven or open-ended prompting — which finds more, and when?
How do I triage agent findings: hallucinations, duplicates, severity inflation?
What failure patterns show up specifically in AI-written code?
How does agentic review fit into an offensive workflow?

Slides#

Your browser can't display the PDF inline. Download the slides.

Module 3: Agentic Coding

Mon, 01 Jan 0001 00:00:00 +0000

Module 3: Agentic Coding: Build#

Using agents to write real code, and what it takes to make that code good: workflows that work (plan first, small steps, verification loops), where AI-generated code fails on security, model tiering, and accountability: you own what the agent ships. The lab closes Day 1 and kicks off the class arc: everyone builds the same networked app to spec, it freezes overnight, and Day 2 attacks it.

Module 6: Capstone

Mon, 01 Jan 0001 00:00:00 +0000

Module 6: Capstone: Implement Foundry-lite#

The capstone: build the machine that does the auditing. Using spec-kit and pi, you implement Foundry-lite — a sanctioned subset of Foundry, Cisco’s open specification for an agentic security-evaluation system — and run your implementation against the Lab 5 vulnbox to find real vulnerabilities. The cut is not a compromise the class made behind the spec’s back: the spec’s §4.2 explicitly asks which roles you will merge, split, or omit, and answering that question through the clarify step is the spec-kit lesson. This module doubles as Day 2’s schedule sponge, and it ends the class: a room-wide walk comparing what each implementation caught, the class debrief, and a short closing lecture: fine-tuning vs. context engineering, taking agentic workflows to production, and what to build first back at your desk.