Course 2B — Securing & Attacking Harnesses and LLMs

The agent is the target.

Course 1 taught you to build a harness. Course 2A taught you to use one for security work. Course 2B inverts the lens: the AI system is what you break, harden, and audit. Prompt injection, memory poisoning, tool and MCP abuse, inter-agent trust escalation, sandbox escapes — and the deterministic governance that bounds them. The thesis: the model is probabilistic; the harness must be deterministic. Thirteen modules, two capstones, ten deep-dives. Every defense attacked, then rebuilt.

~25
hours
13
modules
2
capstones
11
deep-dives
98.4%

The harness is the security boundary, not the model. Course 1 said the model is 1.6% of an agent. Course 2B is what that means for security: every attack — injection, poisoning, abuse, escape — is a harness-layer failure, and every defense is a harness-layer control. The model is probabilistic and injectable by nature. Security comes from deterministic enforcement the model cannot reach.

2A vs 2B: Course 2A is "security engineer gets AI superpowers" — the agent is a tool for security work. Course 2B is "AI engineer learns real security" — the agent is the target being secured. Different object, different buyer, different benchmarks.

Pillar 0 — Foundations
2 modules · ~2 hrs
B0
Legal, Ethics, and Disclosure for AI Security Testing
The traditional computer-crime statutes plus an AI-specific layer (EU AI Act, DMCA § 1201, trade-secret law) the deployer cannot waive. The authorization chain splits at the provider link. A jailbreak is dual-use.
60 MIN
B1
Threat Model of Agentic Systems
The seven attack surfaces: loop, tools, memory, provider, identity, sandbox, inter-agent edges. Every surface mapped to an OWASP ASI risk, a defense module, and a Course 1 architecture it attacks.
60 MIN
Pillar 1 — Injection & Poisoning
2 modules · ~2.5 hrs
B2
Prompt Injection Defense Engineering
The central depth module. Direct/indirect/multi-step injection, taint tracking, secondary-model detection. The probabilistic (CrabTrap) vs deterministic (IronCurtain) enforcement debate resolved.
90 MIN
B3
Memory and Context Poisoning
The sleeper attack: inject in session 1, activate in session 2. Retrieval contamination, context-window flooding, cascading hallucination. The harness-managed-write defense.
60 MIN
Pillar 2 — Trust Surfaces
3 modules · ~4 hrs
B4
Tool and MCP Security
The MCP dual attack surface — tool descriptions (schema poisoning) and tool outputs (injection via results). Evil twins, supply-chain compromise. Signed manifests and registry trust.
90 MIN
B5
Identity and Permission Design
Non-human identities, scoped credentials, token exchange (RFC 8693). The agent never holds a long-lived secret. Credential quarantine from the agent process.
60 MIN
B6
Inter-Agent Trust and Communication Security
Forged orchestrator messages, trust escalation, cascade risk. Signed inter-agent messages, replay protection, compartmentalization. HMAC receipts extended across the mesh.
60 MIN
Pillar 3 — Controls
2 modules · ~2 hrs
B7
Sandboxes and Execution Controls
The last line of defense when injection succeeds. Sandbox hierarchy, escape vectors, default-deny network egress, resource caps. Assume the sandbox will be escaped — design for blast radius.
60 MIN
B8
Observability and Attack Detection
Why per-turn detection fails. Session-level intent tracking, action provenance, anomaly detection. The zero-click HITL bypass chain and the escalation-fatigue attack.
60 MIN
Pillar 4 — Frameworks & Governance
4 modules · ~4.25 hrs
B9
OWASP Agentic Top 10 as Engineering Checklist
The Top 10 is not a reading list — it is a test checklist with an attack procedure and a defense architecture for each ASI risk. Every risk mapped to a defense module and a concrete test.
90 MIN
B10
Microsoft Failure Mode Taxonomy as Red Team Framework
Seven new agentic failure modes from a year of deployed red teaming. The zero-click HITL bypass chain — per-step approvals are insufficient. The offensive complement to OWASP.
45 MIN
B11
Governance and Compliance
NIST AI RMF, the AI BOM, audit trails, policy-as-code. Where enterprise budgets and board attention are moving. The governance-to-engineering bridge.
60 MIN
B12
Harness Security Assessments as a Service
The 6-phase engagement methodology — scope, recon, discover, exploit, report, retest. Turn B0–B11 into a repeatable professional service with a scored deliverable.
60 MIN
Capstones
2 capstones · ~3.5 hrs
CAP-B1
Build a Hardened Agent Harness
Integrate every defense from B0–B11 into a single testable system. Score it against an InjecAgent-style injection battery. Ship a hardened harness with a defense scorecard.
120 MIN
CAP-B2
Run a Full Agent Red-Team Engagement
The offensive counterpart to B1. Execute the 6-phase methodology end-to-end. Run the OWASP checklist and Microsoft taxonomy chains. Ship a red-team engagement report.
90 MIN
Deep-Dives — 11 Security Studies
11 studies · live
SDD-B01
OWASP Agentic AI Top 10 — Offensive Expansion
The full red-team playbook per ASI risk.
SDD-B02
Microsoft Failure Mode Taxonomy v2.0
Seven modes as full case studies + zero-click chain.
SDD-B03
InjecAgent: The Bridge Benchmark
The ~50% injection-resistance measurement instrument.
SDD-B04
CrabTrap Offensive Analysis
Breaking the LLM-as-judge egress governance.
SDD-B05
IronCurtain Offensive Analysis
Attacking the deterministic defense to beat.
SDD-B06
RedAgent: Black-Box Jailbreaking
Most LLMs jailbreakable within 5 queries.
SDD-B07
Agent SBOM and Supply Chain Assessment
The AI Bill of Materials as a security tool.
SDD-B08
NeMo Guardrails
The production guardrail framework behind NemoClaw.
SDD-B09
Prompt Injection Detection Models
Secondary-model approaches and their evasion.
SDD-B10
Academic Offensive Harnesses
PentestGPT, HPTSA, APT-Agent adapted for AI targets.
SDD-B11
Tau: The Reference Harness to Attack and Harden
The real target. Five extension points, three plugins, a measured scorecard.

Prerequisite: Course 1 — the Master Course (or equivalent production harness experience). Course 2B assumes you already understand why the model is only 1.6% of an agent and why the harness is the other 98.4%. All thirteen modules, both capstones, and all eleven deep-dives are live now. Each ships the same eight-artifact stack: teaching document, diagrams, slide deck, teaching script, flashcards, exam, lab specification, and web page. The capstones build on real tau (Hugging Face's educational coding agent) — students harden a real codebase and measure the result with a real defense scorecard.

The course resolves the central tension of AI security: the model is probabilistic and injectable by nature — security must come from deterministic enforcement the model cannot reach. The CrabTrap (probabilistic) vs IronCurtain (deterministic) debate is settled through offensive testing: determinism where enumerable, probability where semantic, composed in defense-in-depth where neither alone suffices.