Module 06 · Agent

Agent security

Everything the model reads is input, and most of it did not come from you. Tool results and retrieved documents are attacker-controlled text landing in the same array as your system prompt, and the model cannot tell them apart.

4 lessons · 3 graded exercises·3.5 hours·intermediate·Prerequisite: Memory and RAG

The context is the attack surface

25 min

Your instructions, the user's question, a retrieved document and a tool result arrive as the same kind of thing. The model has no way to tell which of them you trusted, and it was never given one.

Injection through a tool result

35 min · exercise

Build the attack, watch it work, then try to detect it and find out why detection is a mitigation rather than a fix. The useful output of this lesson is knowing what your detector misses.

Least privilege for tools

30 min · exercise

The model choosing which tool to call is not an authorisation decision, because the model is the part the attacker can reach. Authority belongs to the state the agent is in, not the sentence it just read.

A guardrail that cannot be talked out of

30 min · exercise

A check that reads the same context it is guarding shares the context's compromise. The useful ones run on the action, outside the conversation, on values the attacker never touched.