Week 17 · Season 5 · Shield
The letter that gave orders
You can explain prompt injection, break the lethal trifecta, read the OWASP lists for AI apps, and shrink a fooled assistant's blast radius with least privilege.
This week
- Prompt injection, direct and indirect
- The lethal trifecta and the Rule of Two
- OWASP Top 10 for LLM and agentic apps
- Least privilege and egress allowlists
- Poisoned tools, pinning and fingerprints
How you learn
By hand, map every one of FRIDAY's tools into the three legs (private data, untrusted content, a way out), then build the controls in code, never in the prompt: mark untrusted text as data, scope each tool to the one record it needs, take recipients and hosts from your records, and parse every URL before an outbound request.
What you build
Defend FRIDAY against a scripted attacker: plant a canary, run documents with hidden orders at it, and shrink the blast radius until the attack success rate hits zero. Keep every attack that worked as a test in CI.
Stretch: Give a classmate your FRIDAY for an hour to attack, and add whatever injection they find to your suite.
What you ship
Project 5: Five real friends. Five people use FRIDAY for a week; their problems become tests, and the fixes ship through CI/CD.
- A threat map of FRIDAY's tools with one leg cut and the reason written down
- An attack suite that scores zero, running in CI with the network off
Lessons
- The invoice that gave orders
After this deck you can explain what prompt injection is, why a strict system prompt can't stop it, and why you design for the day an attack gets through.
- Three circles
After this deck you can name the three powers of the lethal trifecta, map which of FRIDAY's tools gives which power, and shrink or gate the one the job needs least.
- Read the lists
After this deck you can use the two OWASP lists for AI apps, tell injection (how it gets in) from excessive agency (how it does damage), and back each answer with proof.
- Shrink the blast radius
After this deck you can apply least privilege: give each tool the smallest key that does the job, take dangerous values from your records, and lock the exits with an allowlist checked in code.
- When the tool is the attacker
After this deck you can explain tool poisoning and rug pulls, fingerprint a tool's definition, and pin the exact version a person reviewed so a quiet change switches the tool off.
- Go deeper: injection, in depth
Go deeper: understand indirect injection, why defence is layers not one wall, and two patterns that beat injection by design: marking outside text (spotlighting) and the dual LLM split.
Labs
Python in the browser, next to the lessons.
Weekend build
- Versus: defend FRIDAY against the letter
A scripted attacker hides orders in the documents FRIDAY reads. Shrink the blast radius until the score hits zero.
Skills you prove
- Threat model
- Threat-model an agent (lethal trifecta, OWASP) and red-team it
Free links for this week
Hand-picked official docs, papers and talks.