Safety attack lab
A helpful agent can be turned against you. How do attackers do it, and how do you stop them?
The idea inside
Injection, excessive agency, data exfiltration, unsafe output: break each chain with one guard.
After this lesson
You can recognize prompt injection, excessive agency, data exfiltration, and unsafe output handling, and the guard that defuses each (OWASP LLM Top 10).
Where it leads
Inside this lesson
That's the real lesson stage, paused. Claim your pass to operate it.
See how AI actually works, end to end.
This lesson is one stop on the full arc. Unlock all of it, and keep it for life.
What you get
- The 34-lesson main path, a finishable route from a word to agents
- Goal tracks for using AI at work and building AI features
- Boss labs that make you apply a whole act, not just recognize it
- Spaced recall that brings each idea back before you forget
- Course memory: every term defined, with links to where it first appears
- A shareable capability card when you finish the main path
- Lifetime access on every device, every future lesson included
Not videos to watch. You predict, operate the machine, then prove it. That is why it stays.
99 interactive lessons and challenges. No videos, no code.
Free launch pass: lifetime access, no card needed
New here? The first lessons are free to try. Start with lesson 0.1
What this lesson shows
Injection, excessive agency, data exfiltration, unsafe output: break each chain with one guard.
The question it opens with
A helpful agent can be turned against you. How do attackers do it, and how do you stop them?
The walkthrough, in the lesson's own words
- The current is hijacked. Tap the guard on the wire to repair the flow.
- Four circuits, four guards. One repaired wire stops each harm.
- New circuit, new attack. Tap the guard on the wire to repair the flow.
- Honest catch: nobody has found a way to fully enforce this boundary. It helps, but the guards you can COUNT on are the other two: scoped privileges and gated sends.
- These four aren't random. Each is a category on the OWASP Top 10 for LLM Applications, the field's shared checklist of how AI apps get attacked:
- Real systems layer several guards, because no single one is perfect. But seeing the circuit tells you where a guard even goes.
- One honest caveat on circuit 1: nobody has found a reliable way to make a model treat fetched text purely as data. Instructions and data share one window, so that boundary helps but can't be fully enforced inside the model. The guards you can count on are architectural: strip the agent's privileges while it reads untrusted content, and gate what leaves.
- And when private data, untrusted content, and a way to send data out meet in one agent, that combination has a name, the lethal trifecta. Lesson 7.7 takes it apart leg by leg.
- You're giving an agent a tool that can read a customer's inbox and send email on their behalf. Where do the guards go?
- Trace the circuit. Treat fetched email as data, not instructions (prompt injection); scope the send tool to drafts or a short allow-list, not arbitrary recipients (excessive agency); and require approval before anything leaves (data exfiltration). Layer them, because no single guard is enough.
Key takeaway
You can spot the common agent attacks and place the one defense that breaks each one.
What you can do after this lesson
You can recognize prompt injection, excessive agency, data exfiltration, and unsafe output handling, and the guard that defuses each (OWASP LLM Top 10).
This is the written summary. The lesson itself is interactive: you predict, drag and operate the mechanism above, and the reveal answers you.