Secure AI agents that plan, use tools and act on people's behalf, including MCP servers, agent identity, sandboxing and multi-agent systems.
Estimated time: 12–23 months · At about 10 hours a week.
Offensive skills are for authorised testing only: your own lab, a practice platform, or a system whose owner has given you written permission. Testing anything else is a crime in most countries.
Learning path
Click a topic to see what to learn and where. Mark topics as you go; your progress is saved in this browser only.
MCP connects AI apps (clients) to servers that offer tools, resources and prompts. Learn the roles, the transports and what each server can see and do.
OWASP's agentic threat list covers tool misuse, privilege compromise, memory poisoning, goal manipulation, rogue agents and more. Use it to frame every review.
Every web page, email, file or tool result an agent reads can carry instructions. With tools, an injection can send data out or change things, not just say something odd.
When one agent can read private data, read untrusted content and send data outside, an injection can steal that data. Remove at least one of the three.
When an agent acts for a user, use delegated, scoped, short-lived tokens and keep a record of both the user and the agent. Token exchange helps with chains of services.
Remote MCP servers use OAuth to decide who may call them. Check audience and scopes, never pass a client's token straight through to another service, and protect the consent step.
An MCP server you install runs code and sees data. Check who wrote it, pin versions, review its tool descriptions for hidden instructions, and watch for changes after install.
Agents that run code or shell commands need isolation: containers with tight limits, microVMs or gVisor, no secrets inside, and network access only where needed.
Design memory that resists poisoning and can be audited.
Assess a multi-agent system for trust and permission problems.
Build traces and alerts that show what an agent did and why.
Test an agent end to end with planted injections.
Hands-on projects and labs
Poison a memory-enabled agent you built so a later session follows a planted instruction, then add a defence.
Build a two-agent system and show one misleading the other, then separate their permissions.
Write detections for an agent sending data to a new destination and test them.
Done when you can…
Lead the security review of a production agent or MCP integration.
Show a working kill switch that stops an agent and revokes its access.
Advanced
Memory and context poisoning
Agents with long-term memory can be taught false facts or hidden instructions that come back later. Separate memories by user, record where each came from, and let people review them.
When agents talk to agents, a compromised or confused one can mislead the rest. Treat messages between agents as untrusted and keep each agent's permissions separate.
Agents that click and type in a browser see every page as possible instructions. Limit them to allowed sites, keep them signed out of sensitive accounts, and confirm risky steps.
Log every step: the task, each tool call with its arguments and result, approvals and the identity used. Without traces you cannot investigate what an agent did.
Test whole tasks, not single prompts: plant injections in the data the agent will read and check what it does. Repeat after every model, prompt or tool change.
Decide which actions agents may take alone, who approves new tools, and how incidents are handled. Map this to the NIST AI RMF and your existing risk process.
An AI agent is a model that can decide on steps and take them: read email, browse the web, run code, call APIs, change records. The Model Context Protocol (MCP) has become a common way to connect agents to tools and data. Every tool you connect turns a model's mistake, or an attacker's injected instruction, into a real action.
Agent security combines identity and access management, application security and sandboxing. The core questions are: who is the agent acting for, what is it allowed to do, what untrusted content can reach it, and what stops it when something goes wrong?
Why it matters
Agents are moving from demos into email, coding, customer service and operations. The risks are new and the guidance is young, so people who understand both agents and security are shaping how this is done.
Typical job roles
EntryDeveloper building agents and MCP serversBuilds tools and integrations with sensible permissions and input checks.
Mid-levelAI security engineer (agents)Reviews agent designs, tool permissions and sandboxes, and tests them for injection.
Mid-levelIdentity engineer for non-human identitiesGives agents their own identities, scoped tokens and audit trails.
SeniorAgent security architectSets the patterns for agent permissions, approvals and isolation across teams.
LeadAI platform security leadOwns the security of the organisation's agent platform and tool ecosystem.
Prerequisites
The LLM and Generative AI Security beginner and intermediate stages, especially prompt injection.
OAuth 2.0 and API authentication basics.
Comfort building small apps in Python or TypeScript.