AI Security Engineering.
Map your agent's attack surface.
Where AI agents look for a way around their rules, and how to defend against it. Built on CM's research: 7 models, 37 prompt conditions, and one framing agents fall for again and again.
Your agent has an attack surface.
You just haven't mapped it yet.
Every AI agent you deploy has an exploitation surface. A set of dimensions along which an adversary (or an accident) can cause it to behave in ways you didn't intend. Most teams don't think about this. They deploy agents, test the happy path, and hope for the best.
Hope is not a security posture.
In CM's research, most prompt tricks produced no measurable effect. One did. Recast the task as a puzzle or a capture-the-flag, and Claude Sonnet 4 reached for a planted backdoor 32 to 40% of the time, despite an explicit instruction to respect every rule.
37 conditions. 12 dimensions. The map.
What made coding agents reach for a planted backdoor despite an explicit rule, measured in real Docker sandboxes on 7 models.
21 lessons. 5 modules.
From attack surface to hardened defenses.
Each module covers a phase of the security engineering process: understand the threat model, reproduce the attacks, build the defenses, red-team your own system.
The AI Attack Surface
Why traditional AppSec doesn't protect AI systems. The new threat model: probabilistic attacks on probabilistic systems. OWASP Top 10 for LLM Applications. MITRE ATLAS attack taxonomy. The Three V's revisited through a security lens.
Prompt Injection & Goal Reframing
Direct prompt injection (overriding system instructions). Indirect prompt injection (Greshake et al.: attacks hidden in retrieved data). Goal reframing as the under-explored attack class: puzzle framing at 38–40%, CTF framing at 32-34%, easter-egg framing at 22%. Why the same prompt moves some models and not others.
Lab: Reproduce 3 goal-reframing scenarios in a Docker sandboxBuilding Guardrails
guardrails architecture and API. Input guardrails: scanning for injection patterns. Output guardrails: PII detection, policy compliance, content filtering. The policy engine: rules enforced programmatically, not hoped-for in the prompt. Combining guardrails with the E3 governance gate.
Permissions & Sandboxing
agent-auth: least privilege for AI. Just-in-time access (temporary permissions that expire). Infrastructure isolation: Docker, gVisor, Firecracker for AI workloads. Network egress allowlists. Blast-radius containment: if one agent is compromised, the damage is bounded.
Red-Teaming & Hardened Capstone
Red-teaming methodology for AI systems. Building a red-team protocol: scope, scenarios, scoring, reporting. Take the E3 capstone, red-team it against all 12 dimensions, fix what fails, re-test. The result: a security certification report with before/after exploitation metrics.
One project. Six courses. Six layers.
In E4 your E3 capstone gets security-hardened. The same project carries forward through E5 and E6 into a deployed Enterprise AI Operating System.
What you need. What you'll use.
Prerequisites
E1 and E3 completed (E2 recommended but not required), or equivalent experience building accountable AI agents with governance middleware. Comfortable with Python, Docker, and basic security concepts.
Tech stack
Python 3.12, Docker and gVisor for sandboxing, open-source guardrails and agent-auth repos (Apache 2.0). The arXiv paper (2604.04561) annotated and walked through scenario-by-scenario.
This is for you if:
Don't take this if:
One price. Lifetime access.
- 21 lessons across 5 modules (video, written, runnable code)
- Red-teaming framework with full trial automation
- Input and output guardrails (production-ready)
- Goal-reframing detection and security audit template
- Annotated arXiv 2604.04561 walkthrough and full code repo (
Apache 2.0)
Want all six courses?
See the Engineering Series bundle →- Is this offensive (red team) or defensive (blue team) — or both?
- Both, and in that order. Modules 1–2 map the attack surface (offense). Modules 3–4 build the defense. Module 5 is the red-team-the-defense capstone. You can't defend what you haven't attacked.
- Do I need a pentest / cybersecurity background?
- Helpful but not required. The attack-surface taxonomy is built from CM's published research (7 models, 37 prompt conditions, 12 dimensions). No prior security background assumed. If you have one, you'll go faster.
- Which attack has no prompt-level fix?
- Goal reframing. In CM's research, an explicit rule in the system prompt did not stop it: the agent reinterprets the task so the rule no longer seems to apply. The defense is operational (sandboxing, and what the agent can see and reach). Module 2 covers it.
- Do I need E3 (Building Accountable AI Agents) first?
- Strongly recommended. The guardrails and permissions architecture from E3 is the foundation E4 attacks and hardens. Skipping E3 is possible if you already have an agent platform — but you'll be filling in context.
- Tools and stack?
- Python, Docker, an LLM API key, and the open-source red-teaming kit that ships with the course (Apache 2.0). No commercial security tools required.
- Time commitment?
- 20–28 hours across 5 modules. The red-teaming capstone is the most demanding — plan a full weekend to run a real attack series.
- Can my company pay for this?
- Yes, especially for security and platform teams. Invoices issued. Email [email protected] subject 'Reimbursement.'
- What's the refund policy?
- €197 courses are non-refundable once you open the course. Unopened, they are refundable in full within 14 days of purchase. The Engineering Series bundle (€797) offers a 14-day conditional refund.
Break your own systems
before someone else does.
7 models. 37 conditions. 12 dimensions. The map your security posture needs. €197.
Get on the waitlist