Course Objective & Scope
In indirect prompt injection the attacker talks not to the user but to the content the model reads: hidden text in an email, white text in a PDF or a tool response can hijack an agent. The course walks through these attack surfaces in RAG, browser agents, email assistants and MCP integrations, along with data exfiltration chains via markdown images and links.
The defensive part designs spotlighting/datamarking, dual-LLM and plan-then-execute patterns, the CaMeL approach, egress controls and human approval points. Participants map trust boundaries for their own data flows.
Who Should Attend?
- AI engineers building RAG and agent applications
- Teams responsible for copilot, email and document assistant integrations
- Security architects and red team members
- Prerequisite: LLM application development and basic prompt injection knowledge
Key Takeaways
- Inventory every untrusted content source in a system
- Build indirect injection scenarios via documents, web pages and tool outputs
- Close markdown- and URL-based data exfiltration paths
- Apply the dual-LLM or plan-then-execute pattern to an agent
- Define approval rules for actions untrusted content could trigger
Curriculum
Untrusted Content and Trust Boundaries
- Web, email, documents, RAG and tool outputs
- Losing the separation between data and instructions
Attack Vectors
- Instructions hidden in text, metadata and images
- Injection through MCP tool descriptions and tool responses
Data Exfiltration Chains
- Exfiltration via markdown images, links and tool calls
- End-to-end attack lab on an email assistant
Architectural Defence Patterns
- Spotlighting and datamarking
- Dual LLM, plan-then-execute and the CaMeL approach
Operational Controls
- Egress restrictions, URL allowlists and output rendering policies
- Human approval and per-action risk thresholds
Other Courses in This Category
-
Teaches how sensitive data leaks from LLM applications through memorisation, secrets in system prompts, unauthorised RAG access, cross-tenant leakage and logs, and how to prevent it with permission-aware retrieval and DLP controls.
- Live Course
- 5 modules
-
Shows how to control excessive functionality, permissions and autonomy granted to AI agents using tool design, parameter validation, approval flows and an agent permission matrix, based on OWASP LLM06 and agentic risk guidance.
- Live Course
- 5 modules
-
Explains how poisoned documents planted in a knowledge base manipulate retrieval results and LLM answers, and how to prevent this with ingestion pipeline controls, source trust scoring and retrieval anomaly monitoring.
- Live Course
- 5 modules
-
Covers pickle-based code execution, backdoors, licensing and provenance risks in models sourced from hubs such as Hugging Face, and how to manage them with safetensors, ModelScan, model signing and an AI-BOM (CycloneDX).
- Live Course
- 5 modules
-
Teaches how to prevent confused deputy and privilege escalation risks in autonomous agents through workload identity, OAuth 2.0 On-Behalf-Of delegation, dynamic scope attenuation and OPA/Cedar policy enforcement.
- Live Course
- 5 modules
-
Combines STRIDE with MITRE ATLAS and the OWASP Top 10 for LLM and Agentic AI to produce end-to-end AI threat models, trust boundary diagrams and control matrices for LLM, RAG and agent architectures.
- Live Course
- 5 modules
Get in touch
