Security

1. 1
   Threat catalogs30 min

   OWASP MCP Top 10

   And OWASP Top 10 for LLM Applications (30 min).

2. 2
   Agent-specific framing10 min

   The lethal trifecta for AI agents

   Simon Willison

   And Prompt injection explained (talk with transcript, 15 min).

3. 3
   Real exploit15 min

   GitHub Copilot: Remote Code Execution via Prompt Injection (CVE-2025-53773)

   Embrace The Red

   A coding-agent attack chain end to end.

4. 4
   Video45 min

   When AI Writes Code: Rethinking App Security

   Isaac Evans of Semgrep

   AI-generated vulnerabilities, SAST, security assistants, feedback loops, and risks created by coding agents.

5. 5
   Hands on20 min

   Finding vulnerabilities in modern web apps using Claude Code and OpenAI Codex

   Semgrep

   Agent-assisted triage in practice.

6. 6
   Coding-agent threat model14 min

   Safety and Security for Code-Executing Agents

   Fouad Matin of OpenAI

   Remote code execution, prompt injection, exfiltration, containers, network restrictions, approvals, and OS-level sandboxing.

7. 7
   Hands-on labs

   Web Security Academy

   PortSwigger

   Do the Web LLM attacks labs, including indirect prompt injection (≈ 60 min for two labs).

• Link

  Semgrep

  SAST

  And CodeQL. Secrets: gitleaks. Dependencies/SCA: OSV-Scanner. Run all three classes in the build.

• Link

  Making Claude Code more secure and autonomous with sandboxing

  Anthropic

  And the claude-code-security-review GitHub Action.

• Link

  MCP Tool Poisoning

  OWASP

  And the original Invariant Labs disclosure, MCP Security Notification: Tool Poisoning Attacks.

• Link

  Agentic AI Threats and Mitigations

  OWASP

  And the broader OWASP GenAI Security Project.

• Link

  Design Patterns for Securing LLM Agents against Prompt Injections

  Research

  ; NIST, Strengthening AI Agent Hijacking Evaluations.

• Practical sandboxing38 min

  Why and How You Need to Sandbox AI-Generated Code

  Cloudflare's Harshil Agrawal

  Capabilities, secrets, networking, cleanup, isolation surfaces, and indirect prompt injection.

• Lab companion12 min

  Web Security Academy series introduction

  Rana Khalil

  .

• Link

  Threat Modeling: Designing for Security

  Adam Shostack

  Use the first edition; the second edition, retitled for an AI world, is announced for February 2027.

Threat-model the entire agent workflow: user input, repository content, retrieved web pages, tools, credentials, MCP servers, generated commands, logs, and deployment. Apply least privilege, explicit allowlists, secret isolation, sandboxing, and human approval for irreversible actions.

Run SAST (Semgrep or CodeQL), dependency/SCA (OSV-Scanner), and secret scans (gitleaks) in CI. Plant a harmless indirect-prompt-injection string in an untrusted fixture and verify that the agent treats it as data rather than instructions. Write a short incident playbook for credential exposure, malicious tool output, and runaway cost.