Language
Preparing your course and saved progress.
PATH OVERVIEW
Find, fix, and verify security failures in a realistic local AI application.
A hands-on AI security engineering path built around Aegis Vulnerable AI Lab, beginning with a deterministic cross-tenant exploit, tenant isolation, object authorization, threat modeling, and cumulative security gates.
WHO THIS PATH IS FOR
What you'll build
Use an intentionally vulnerable AI application to reproduce attacks, implement bounded controls, preserve legitimate utility, and verify security outcomes with deterministic evidence.
The system evolves across the complete curriculum. Each published phase delivers a bounded capability; later capabilities are added only when their curricula are published.
A · Published capability
Aegis Lab · First Exploit · Tenant Isolation · Authorization · Threat Modeling · Security Gates
Launch the ready-made Aegis Vulnerable AI Lab, reproduce a deterministic cross-tenant security failure, implement and verify tenant-scoped retrieval, map the AI data flow and trust boundaries, implement object authorization through a second learner-owned policy seam, convert observed threats into testable requirements, and pass a cumulative attack-plus-utility gate.
B · Published capability
Prompt Injection · Untrusted Retrieval · Retrieval Authorization · Output Boundary · Document Provenance · Local Egress
Reproduce a direct and an indirect prompt-injection case against the local Aegis lab, implement a retrieved-content-trust boundary so authorized content stops acting as instruction, extend authorization across retrieval-evidence caching and revalidation, validate structured model output before any downstream interpretation, add document-provenance and local-egress controls through two bounded sublabs, and pass a cumulative gate proving all five Phase B boundaries hold together without destroying legitimate RAG utility.
PREREQUISITE EXPECTATION
Basic programming familiarity, comfort using a terminal and Git, and the ability to run a local Python application are expected. Prior AI security experience is not required.
Curriculum
First Attack
Launch the ready-made Aegis Vulnerable AI Lab, reproduce a deterministic cross-tenant security failure, implement and verify tenant-scoped retrieval, map the AI data flow and trust boundaries, implement object authorization through a second learner-owned policy seam, convert observed threats into testable requirements, and pass a cumulative attack-plus-utility gate.
6 units
Secure RAG
Reproduce a direct and an indirect prompt-injection case against the local Aegis lab, implement a retrieved-content-trust boundary so authorized content stops acting as instruction, extend authorization across retrieval-evidence caching and revalidation, validate structured model output before any downstream interpretation, add document-provenance and local-egress controls through two bounded sublabs, and pass a cumulative gate proving all five Phase B boundaries hold together without destroying legitimate RAG utility.
6 units
Free preview
A01 · First Attack
A02 · First Attack
A03 · First Attack
Starter path
Start with three complete units from AI Engineering Foundations and use the same learning system as the full course. No account or credit card is required to begin.
Launch Aegis and reproduce the first security failure
A01
Fix the first tenant boundary and prove utility
A02
Map the AI data flow and trust boundaries
A03
METHODOLOGY
TRUST & METHODOLOGY
This path maps authored curriculum skills to practical AI security engineering work. Coverage is not a job-readiness score, hiring promise, certification, or substitute for demonstrated work.
Course outcomes come from the projects, tasks, and checks learners actually complete.
Practical gates and completion are learner-controlled. Quick Checks are formative and the product does not fabricate competence claims.
Course completion is not a hiring promise, certification, rating, or substitute for demonstrated work.
ACCESS
FREE PREVIEW
The public roadmap and complete preview units from the real course.
Start freeFULL PATH
One-time access to every published unit plus progress, Quick Checks, lesson notes, and backup tools.
Choose one course or the four-course All-Access bundle.
Compare access optionsC · Published capability
Capability Inventory · Tool Authorization · Approval Authority · Memory Trust · MCP Authorization · Browser Approval
Inventory the ready-made Aegis agent runtime's capabilities and separate model proposal from application permission (C13), implement the paired tool-authorization and approval policies that stop confused-deputy and non-approver-grant attacks (C14), implement the memory-trust boundary that keeps an unprovenanced write from being admitted as trusted context (C15), implement per-call MCP capability authorization against the fixed local training server (C16), implement the browser sensitive-action approval boundary (C17), and pass a cumulative gate proving all five Phase C boundaries hold together while every declared utility workflow keeps working (C18).
D · Published capability
Threat Hypotheses · Evidence-Based Scoring · Protected Inputs · Release Gate Reading · Repeatable Test Program
Use the ready-made, already-complete Aegis evaluation harness to convert the threat model and controls from Phases A-C into a repeatable AI security test program: write falsifiable threat hypotheses against real Aegis evidence (D19), implement the two decisions the harness cannot make on its own -- whether execution evidence really shows containment, and whether a completed run really shows legitimate utility (D20), prove adversarially that protected holdout inputs are not exposed through learner-readable dataset interfaces (D21), learn to read a declarative release gate that cannot be fooled by a high average (D23), and re-run the same two accepted policies, unmodified, across the full four-partition dataset for a reproducible capstone release decision (D24).
E · Published capability
AI Asset Inventory Literacy · Integrity Binding Literacy · Artifact Verification · Constrained-Runtime Literacy · Budget and Denial-of-Wallet Literacy · Verified and Constrained AI Runtime
Use the ready-made Aegis integrity and constrained-runtime surfaces to read a real AI asset inventory and provenance model (E25), read Aegis's real, already-unconditional tool/MCP origin-argument-schema binding as dependency, tool, and MCP integrity evidence (E26), implement the one genuine gap -- a lightweight artifact-verification and attestation decision that binds a claimed statement to the trusted inventory's observed subject, digest, and builder authority (E27), read Aegis's real, already-enforced egress, sensitive-field, and capability-authorization boundaries as the constraining evidence a full sandbox would otherwise have to build (E28), read Aegis's real, already-fixed agent/handoff/MCP/browser resource budgets and the canonical budget-exhaustion event as denial-of-wallet evidence (E29), and re-run the accepted E27 policy, unmodified, composed with E26/E28/E29's read-only structural evidence, for a reproducible capstone release decision (E30).
F · Published capability
Detection Evidence Literacy · Incident Triage Literacy · Response Authorization · Remediation Verification Literacy · Control Plane Literacy · AI Security Control Plane
Use the ready-made Aegis incident, response, replay, evidence, and Control Plane surfaces to read real canonical-event detection evidence (F31), read real incident-triage and evidence-preservation behavior (F32), implement the one genuine gap -- a response-authorization decision that binds a proposed response's target to the incident's own recorded affected scope (F33), reuse the already-accepted Phase D evaluation harness to reason about remediation verification (F34), read the real, already-non-authoritative AI Security Control Plane (F35), and compose one end-to-end purple-team incident that reuses F33's own seam through a fresh authorization cycle for the final course release decision (F36).
OUTCOMES
OUTCOME 01
Launch Aegis Vulnerable AI Lab and reproduce a deterministic cross-tenant security failure.
OUTCOME 02
Implement tenant-scoped retrieval and object authorization while preserving legitimate utility.
OUTCOME 03
Map AI data flows and trust boundaries, then convert observed threats into testable security requirements.
OUTCOME 04
Pass a cumulative attack-and-utility gate and produce evidence for the implemented security controls.
Agent Security
Inventory the ready-made Aegis agent runtime's capabilities and separate model proposal from application permission (C13), implement the paired tool-authorization and approval policies that stop confused-deputy and non-approver-grant attacks (C14), implement the memory-trust boundary that keeps an unprovenanced write from being admitted as trusted context (C15), implement per-call MCP capability authorization against the fixed local training server (C16), implement the browser sensitive-action approval boundary (C17), and pass a cumulative gate proving all five Phase C boundaries hold together while every declared utility workflow keeps working (C18).
6 units
Security Evals
Use the ready-made, already-complete Aegis evaluation harness to convert the threat model and controls from Phases A-C into a repeatable AI security test program: write falsifiable threat hypotheses against real Aegis evidence (D19), implement the two decisions the harness cannot make on its own -- whether execution evidence really shows containment, and whether a completed run really shows legitimate utility (D20), prove adversarially that protected holdout inputs are not exposed through learner-readable dataset interfaces (D21), learn to read a declarative release gate that cannot be fooled by a high average (D23), and re-run the same two accepted policies, unmodified, across the full four-partition dataset for a reproducible capstone release decision (D24).
5 units
Runtime Integrity
Use the ready-made Aegis integrity and constrained-runtime surfaces to read a real AI asset inventory and provenance model (E25), read Aegis's real, already-unconditional tool/MCP origin-argument-schema binding as dependency, tool, and MCP integrity evidence (E26), implement the one genuine gap -- a lightweight artifact-verification and attestation decision that binds a claimed statement to the trusted inventory's observed subject, digest, and builder authority (E27), read Aegis's real, already-enforced egress, sensitive-field, and capability-authorization boundaries as the constraining evidence a full sandbox would otherwise have to build (E28), read Aegis's real, already-fixed agent/handoff/MCP/browser resource budgets and the canonical budget-exhaustion event as denial-of-wallet evidence (E29), and re-run the accepted E27 policy, unmodified, composed with E26/E28/E29's read-only structural evidence, for a reproducible capstone release decision (E30).
6 units
Security Operations
Use the ready-made Aegis incident, response, replay, evidence, and Control Plane surfaces to read real canonical-event detection evidence (F31), read real incident-triage and evidence-preservation behavior (F32), implement the one genuine gap -- a response-authorization decision that binds a proposed response's target to the incident's own recorded affected scope (F33), reuse the already-accepted Phase D evaluation harness to reason about remediation verification (F34), read the real, already-non-authoritative AI Security Control Plane (F35), and compose one end-to-end purple-team incident that reuses F33's own seam through a fresh authorization cycle for the final course release decision (F36).
6 units