Nancy Muriithi #SheHacks2026

AI agents now read your email, run your code and hold your API keys. If I wanted to learn AI Agent Security, I'd do this. ✅ Stage 1: Agent Threat Modeling - Learn: OWASP Top 10 for LLMs, STRIDE, the Confused Deputy problem and data flow mapping. - Practice: Threat model an agent that reads emails and writes to a CRM, listing every injection and exfiltration path. - Why: An agent's legitimate privileges are the attack surface. Stage 2: Prompt Injection - Learn: Direct vs. indirect injection, multi-turn attacks (Crescendo), payload splitting and encoding evasion. - Practice: Build a harness that attacks an agent you own with multi-turn injections and logs which ones succeed. - Why: "Ignore previous instructions" is the easy case. Real attacks build over multiple turns. Stage 3: Agent Config & Instruction File Attacks - Learn: AGENTS.md, CLAUDE.md, Cursor rules and hidden instructions in config files. - Practice: Audit instruction files in 5 open-source repos and flag anything an agent should never follow. - Why: Agents trust the files they read, and those files can tell them to do things you never asked for. Stage 4: MCP & Tool Security - Learn: MCP security, tool poisoning, shadow tools and input validation. - Practice: Write an MCP server that validates tool parameters with Pydantic and blocks admin tool calls from non-admin sessions. - Why: Agents are only as secure as the tools they call. Stage 5: Least Privilege & Sandboxing - Learn: Excessive agency, permission scoping, containers and network egress controls. - Practice: Run an agent in a locked-down container with a read-only filesystem and no secrets in its environment. - Why: Assume the agent will be tricked. Limit the damage. Stage 6: Secrets, Identity & Delegated Access - Learn: OAuth2 for machine identities, short-lived scoped tokens, secrets vaults and approval gates. - Practice: Build an auth broker where an agent acts with a scoped, time-limited token instead of a user's password. - Why: Agents need hands, but never the master keys. Stage 7: RAG & Memory Poisoning - Learn: Vector DB access control, document and memory poisoning, row-level security. - Practice: Poison a RAG pipeline you own, then add retrieval filters and provenance checks that stop it. - Why: Whoever controls what the agent retrieves influences every answer. Stage 8: PII & Data Guardrails - Learn: Masking, tokenization and redaction proxies. - Practice: Build a proxy that swaps SSNs and card numbers for placeholders before the LLM sees them. - Why: Raw customer data shouldn't reach a third-party API. Stage 9: Output Validation & Action Guardrails - Learn: Schema validation, NeMo Guardrails and approval gates for destructive actions. - Practice: Block exfiltration-style links in outputs and require human approval for delete, send and payment tool calls. - Why: Enforce safety in code, not in the system prompt. Stage 10: Automated Red Teaming - Learn: PyRIT, Garak, LLM fuzzing and CI/CD security gates. - Practice: Run 1,000 adversarial payloads against your agent on every PR and block risky merges. - Why: Manual red teaming doesn't scale. Stage 11: Monitoring, Audit & Incident Response - Learn: Tool-call tracing, audit logs, anomaly detection and kill switches. - Practice: Build an append-only log of prompts, tool calls and outputs, plus a kill switch that revokes access. - Why: You must prove what happened and stop it fast. Stage 12: Public CVEs & Portfolio - Learn: Responsible disclosure, writing advisories and AI bug bounties. - Practice: Find a bug in an open-source agent framework or MCP server, disclose it responsibly and publish a teardown. - Why: Public work is the fastest way to prove you can do this. Bookmark and Repost! Guide: 5 red flags to check in the files your AI agents read. dhanushnehru.gumroad.com/l/a…