// Track

Agent Infrastructure Security

Locking Down the Stack Attackers Want Most

Your agent stack is a new attack surface — credentialed, always-on, and programmable in plain language. Lock it down: secrets hygiene when agents touch env files, blocking gates for topology and PII leaks, direct and indirect prompt injection defense, least privilege, the attacker's kill chain, and the modern CAPTCHA layer that breaks the economics of mass automation.

Recommended: Complete Autonomous Agent Trust first

10 lessons~88 min total

Lessons are shown in recommended order. Complete them in sequence for the best experience — or jump to any lesson.

Lesson 606·8 min read

The Agent Attack Surface

An agent stack is not just an app with a chatbot on top — it is a new class of attack surface that combines a live process, real credentials, tool access, and a natural-language control channel that anyone who can write to it can attempt to program.

Lesson 607·9 min read

Secrets Hygiene: When Agents Touch Your Env Files

Agents write output — logs, config files, transcripts, documentation — and they reproduce what they saw in context. A secret that passes through an agent's context window is one step from a git commit, a log file, or a PR diff unless specific gates block it.

Lesson 608·9 min read

Infrastructure Exposure: Don't Publish Your Topology

Internal hostnames, service port numbers, filesystem paths, and organization-internal identifiers are reconnaissance gold — and agents reproduce what they see in context, which means every agent-generated document is a potential topology leak without a sanitization gate.

Lesson 609·8 min read

PII Leak Paths in AI Pipelines

PII enters your AI pipeline through user context and exits through generated content, RAG corpora, embeddings, and every fork — and fixing the source file is not the same as fixing the leak.

Lesson 610·9 min read

Prompt Injection I: Direct Attacks

The control channel is natural language — anyone who can write to it can try to program it, and the only durable defense is moving security out of the prompt and into privilege boundaries.

Lesson 611·9 min read

Prompt Injection II: Indirect Injection & Tool Poisoning

The attacker never talks to your agent — they plant instructions in content your agent will read, then wait for it to do the work for them.

Lesson 612·8 min read

Least Privilege for Agents: Allowlists & Sandboxing

An agent that starts with zero tools and earns only what its job needs has a blast radius limited to exactly what it can do — the entire principle of least privilege, applied to the agent era.

Lesson 613·9 min read

The Attacker's Playbook: How Agent Systems Get Owned

Every lesson in this track is one layer of defense — this lesson shows what happens when a layer is missing, by walking the full kill chain an attacker uses against an agent stack from first reconnaissance to persistent memory poisoning.

Lesson 614·9 min read

CAPTCHAs Reborn: Bot Defense in the Agent Era

The agent era didn't make CAPTCHAs obsolete — it made them more essential than ever, because bots are now cheap, smart, and scalable, and your AI endpoints are money pipes an attacker can point at your bill.

Lesson 615·10 min read

Capstone: The Lockdown Audit

Security is a gate problem, not a vigilance problem — every rule in this track ends as an automated check, and this capstone gives you the audit script that runs them all.