FREE COURSE / SELF-PACED LEARNING

AI Agent Security Engineering: Prompt Injection, Identity, MCP, and Tool Controls

Learn AI agent security engineering through prompt injection defenses, task-scoped identity, MCP authorization, secure tools, memory and runtime controls.

Read the first lesson Explore the curriculum

Read freely. Create an account to save your completed lessons.

Experience level
Intermediate
Curriculum
3 modules · 6 lessons
Estimated reading
25 min
Language
English

Reading estimates use lesson text and an allowance for diagrams. Reflection, exercises and optional linked resources take additional time. These are estimates, not measured completion times.

KNOW WHAT YOU’RE WORKING TOWARD

What you’ll learn

  • Map the data, instruction, identity, authority, and effect paths of an AI agent without treating the model as the whole system.
  • Design controls that keep untrusted content from silently expanding an agent's permitted task or tool authority.
  • Review an MCP or comparable tool connection for server trust, token handling, argument validation, and target-side enforcement.
  • Define adversarial tests, proportionate telemetry, stop conditions, revocation, and recovery for consequential agent actions.

Is this the right course for you?

Who it’s for

Application-security engineers, AI platform teams, security architects, developers, and technical risk practitioners reviewing agent-enabled systems.

Scope and boundaries

Preventive security architecture and operational controls for AI agents, tool use, MCP integrations, retrieval, and memory. It does not teach model training or offensive exploitation.

How you’ll learn

Self-paced reading built around one continuous support-agent scenario, explanatory diagrams, and current primary-source references. Optional resource study takes additional time.

Before you begin

  • Basic application and access-control concepts — You should understand accounts, APIs, permissions, and logs. No model-development or MCP implementation experience is required.

About this course

A guided security-engineering course for people who design, review, or govern AI agents. You follow one customer-support agent from a harmless summarization feature to a system that can search records, issue refunds, send messages, and retain memory. At each step, you learn how to separate model behavior from application authority and place enforceable controls around identity, untrusted content, tools, data, approvals, telemetry, and recovery.

TRY THE REASONING / FICTIONAL SCENARIO

The refund assistant reads an instruction hidden in a ticket

A fictional support agent may retrieve one customer's history and propose a limited refund. An attached email tells the assistant to search other customer records and send them to an external address. The model proposes the send action, but no target-side outcome has yet been established.

Your task

Identify the untrusted-content boundary, the authority the agent should possess, the independent controls that must deny or challenge the proposal, and the evidence needed to establish whether any disclosure occurred.

Compare your reasoning

The attachment is data, not authority. Keep external content out of instruction and policy channels; restrict available tools and destinations; bind retrieval and credentials to the active customer and task; validate arguments and tenant ownership; require meaningful confirmation for consequential transfer; and verify any effect at the destination. A proposed call is not proof of completed disclosure, and an unexpected action alone does not prove prompt injection caused it.

This example is a reflection exercise, not a scored assessment.

FOLLOW THE LEARNING PATH

Course curriculum

MODULE 1

Module 1: See the System and Its Boundaries

Begin with the complete agent action path, then follow untrusted content through it. This foundation prevents model-focused safeguards from hiding ordinary identity, application, and integration risks.

  1. Start With the Action, Not the ModelMap a support agent from human request to external effect and discover why data flow and authority flow must be reviewed separately.4 min reading
  2. Contain Prompt Injection Before It Reaches AuthorityFollow a hidden instruction from a support ticket into the agent's context and place independent controls between generated intent and external action.4 min reading

MODULE 2

Module 2: Bind Identity, Tools, and Data

Give the agent only the authority required for the current task, then carry that boundary through MCP-style tool connections, retrieval, memory, and sensitive data handling.

  1. Give the Agent Its Own Identity and a Smaller GrantSeparate the customer, employee, application, agent instance, credential, and target account so delegated authority remains attributable and narrow.4 min reading
  2. Secure MCP and Other Tool Connections End to EndReview the full connection from tool discovery and authorization to argument validation, target policy, evidence, and server trust.4 min reading
  3. Bound Retrieval, Memory, and Sensitive DataDecide what the agent may retrieve, what can persist, and which evidence is sufficient without building a second uncontrolled copy of sensitive information.4 min reading

BUILD ON THE RIGHT FOUNDATION

These courses address different scopes. Choose the foundation or follow-on that fits your next question.

Beginner

AI Awareness Fundamentals

Awareness and decision-making rather than model development or advanced machine-learning engineering.

9 lessons · 29 min estimated reading

Sources and editorial review

Reviewed by Threat Intelligence Lab

Sources linked in the lessons provide context and further reading. Check the original documentation for current platform behavior and requirements.

Selected references are shown here; the lessons contain the full reading lists.

About this learning content: Courses, lessons, assessments, explanations and illustrations may be created with the help of artificial intelligence. We review and check the material and do our best to avoid incorrect or outdated information, but mistakes, omissions or ambiguous questions may remain. Please verify information before relying on it for professional, security, legal or operational decisions. Read the full notice or report an issue.