Course 10 of 10
Agent security
Every other course builds an agent that works; this one assumes an attacker and asks what they can do to it. Across nine lessons you put one target agent — Vertex, a multi-tenant support agent — under each class of attack, and learn the control that stops each: the trust boundary behind all injection, direct and indirect prompt injection, tool-output poisoning, the exfiltration channels teams forget, keeping secrets out of context entirely, tenant isolation at the data layer, least privilege as blast-radius control, the supply-chain risk in tools and MCP servers and skills, and the adversarial testing that keeps it all honest. It is defensive throughout — the attacks run only against the course's sandboxed practice agent — and it sits right after Agent operations, because running an agent responsibly and running it under attack are two halves of the same job — you cannot claim the first without the second.
Start lesson 01The attack surface
- 01The agent attack surfaceWhy an agent is a bigger target than a chatbot, and the one boundary that explains most of it.13 min
- 02Direct prompt injectionThe user tells the agent to ignore its instructions. Whether that works should not be left to the model's mood.14 min
- 03Indirect injection and tool poisoningThe dangerous injections aren't in the message you can see. They're in what the agent reads on its own.14 min
What attackers want
- 04Data exfiltrationGetting the secret out is a separate step from reaching it — and the channels are easy to miss.13 min
- 05Secrets and sensitive dataThe strongest control for a secret is architectural: the agent never holds it.12 min
- 06Tenant isolationIn a multi-tenant agent, one crossed boundary is another customer's breach.13 min
Defence in depth
- 07Least privilege and sandboxingAssume the agent is compromised. Least privilege decides whether that is a shrug or a catastrophe.13 min
- 08Supply chain: tools, MCP, and skillsYour agent runs code and content you didn't write. That is a trust decision, whether or not you made it deliberately.13 min
- 09Adversarial testing and incident responseRed-teaming is a fixture you run on every release, and every landed attack is the start of an investigation.14 min