Model Online / On-Site
Duration
Modules 5 modules

Course Objective & Scope

Agents that analyse data, plot charts, query databases or automate infrastructure frequently generate and execute Python, SQL, Bash or JavaScript at runtime. Covered under OWASP LLM05 (Improper Output Handling) and OWASP Agentic AI (Unexpected Code Execution), passing unvalidated model output into eval/exec, shell commands or browser DOM sinks can quickly escalate into full remote code execution (RCE).

This course dissects real exploit chains in code interpreters, Text-to-SQL pipelines and automation agents, guiding participants to implement Abstract Syntax Tree (AST) validation, parameterised query layers, constrained DSLs and safe execution policies.

Who Should Attend?

  • Engineers building code-generating or code-executing agents (Text-to-SQL, data analysis, DevOps assistants)
  • Application security (AppSec) engineers and penetration testers
  • Backend and platform security teams
  • Prerequisite: Python/JavaScript development experience and foundational application security knowledge

Key Takeaways

  • Identify every dangerous sink where LLM output reaches code, query or command interpreters
  • Eliminate RCE vectors in Python eval/exec, experimental DataFrame/agent utilities and shell calls
  • Enforce read-only database roles, SQL AST validation and row-level security (RLS) in Text-to-SQL pipelines
  • Replace unconstrained code generation with a restricted DSL or type-safe tool schema
  • Prevent XSS, SSRF and server-side template injection (SSTI) triggered by rendered LLM outputs

Curriculum

Attack Surfaces Where LLM Output Becomes Executable Code
  • Taxonomy of OWASP LLM05 Improper Output Handling and Agentic Unexpected Code Execution
  • From prompt injection to RCE: real-world incidents in data analysis, reporting and automation agents
Python, Shell and Interpreter Exploits
  • Breakouts via eval, exec, subprocess and Python object introspection
  • AST parsing, module allowlisting and blocking dangerous built-in calls
Secure Text-to-SQL and Database Query Generation
  • Second-order injection, side-channel leakage and resource exhaustion in LLM-generated SQL/Cypher
  • Query AST validation with SQLGlot, read-only roles, query timeouts and Row-Level Security (RLS)
Output Security in Web, Template and Network Layers
  • Preventing XSS, DOM clobbering and malicious link/image injection during Markdown/HTML rendering
  • Defending against server-side template injection (SSTI) and agent-triggered SSRF
Safe Design Patterns as Alternatives to Raw Code Generation
  • Replacing free-form code with declarative JSON DSLs and pre-verified function schemas
  • Handing off mandatory code execution workloads to ephemeral isolated sandboxes

Other Courses in This Category

  • Sandboxing and Isolated Execution Environments for AI Agents

    Teaches how to isolate code-executing, file-processing and browser-using AI agents inside secure sandboxes using Firecracker microVMs, gVisor, Kata Containers, WebAssembly and strict network egress controls.

    AI Security & Red Teaming Corporate
    Live Course
    5 modules
    View
  • Prompt Injection Attacks and Defenses for LLM Applications

    Hands-on training on direct prompt injection, jailbreak techniques and system prompt leakage, showing developers how to detect and defend against them with input classifiers, instruction hierarchy and tools such as garak.

    AI Security & Red Teaming Corporate
    Live Course
    6 modules
    View
  • Indirect Prompt Injection in RAG and Agent Systems

    Covers hidden instructions delivered through web pages, emails, documents, RAG sources and MCP tool outputs, data exfiltration chains, and architectural defences such as spotlighting, the dual-LLM pattern and CaMeL.

    AI Security & Red Teaming Corporate
    Live Course
    5 modules
    View
  • Sensitive Data Exposure in LLM Applications

    Teaches how sensitive data leaks from LLM applications through memorisation, secrets in system prompts, unauthorised RAG access, cross-tenant leakage and logs, and how to prevent it with permission-aware retrieval and DLP controls.

    AI Security & Red Teaming Corporate
    Live Course
    5 modules
    View
  • Tool Misuse and Excessive Agency in AI Agents

    Shows how to control excessive functionality, permissions and autonomy granted to AI agents using tool design, parameter validation, approval flows and an agent permission matrix, based on OWASP LLM06 and agentic risk guidance.

    AI Security & Red Teaming Corporate
    Live Course
    5 modules
    View
  • RAG Poisoning and Knowledge Base Security

    Explains how poisoned documents planted in a knowledge base manipulate retrieval results and LLM answers, and how to prevent this with ingestion pipeline controls, source trust scoring and retrieval anomaly monitoring.

    AI Security & Red Teaming Corporate
    Live Course
    5 modules
    View

Get in touch