Securing AI Applications: Prompt Injection and Beyond
OWASP LLM Top 10, jailbreaks, data leakage and defensive design.
Taught by Kiran Basnet · Security Engineer
What you'll learn
- Map an LLM application's attack surface against the OWASP Top 10 for LLM Applications
- Demonstrate direct, indirect and multimodal prompt injection and explain why it cannot be fully patched
- Design trust boundaries and least-privilege tool interfaces that limit the impact of a hijacked model
- Prevent leakage of personal data, secrets and system prompts with detection, redaction and output handling
- Deploy layered guardrails and red-team an application with automated and manual techniques
- Instrument, monitor and respond to security incidents in AI features
About this course
Securing AI Applications: Prompt Injection and Beyond is an advanced course for software engineers, security engineers and architects who are shipping features built on large language models and need to defend them. AI security has become a mandatory topic: assistants that read email, browse the web and call tools can be hijacked by text they encounter, leak personal data and secrets, or take actions nobody authorised. You will work through the OWASP Top 10 for LLM Applications, understand direct, indirect and multimodal prompt injection in depth, and learn the defensive design patterns that actually hold up, including trust boundaries, least-privilege tool design and the lethal trifecta. Hands-on lessons cover PII and system-prompt leakage prevention, securing agents and MCP integrations, guardrail classifiers, red-teaming with promptfoo, garak and PyRIT, and building monitoring and incident response for AI features. You should be comfortable with Python and familiar with basic application security concepts.
Course content
8 lessons- 1The New Attack Surface: OWASP Top 10 for LLM ApplicationsWhy LLM apps break the old security model, the ten OWASP risk categories, and how to threat-model a feature.Preview
- 2Prompt Injection: Direct, Indirect and MultimodalHands-on with the attacks: user-supplied jailbreaks, instructions hidden in documents and web pages, and payloads in images.
- 3Defensive Design: Trust Boundaries and Least PrivilegeThe lethal trifecta, dual-model patterns, capability-scoped tools and the architecture that survives a successful injection.
- 4Preventing Data Leakage: PII, Secrets and System PromptsDetect and redact personal data, keep secrets out of model reach, and treat system prompts as public.
- 5Securing Tool Use and Agents: Excessive AgencyScoped permissions, confirmation for destructive actions, sandboxing, and the specific risks of MCP servers.
- 6Guardrails and Input/Output FilteringLayer classifiers, structured outputs and deterministic checks around the model, and know what each layer can and cannot stop.
- 7Red-Teaming Your AI ApplicationA manual attack playbook, automated scanning with promptfoo, garak and PyRIT, and turning findings into regression tests.
- 8Monitoring, Logging and Incident ResponseDetection signals for AI attacks, logging that does not create new leaks, and a playbook for when something goes wrong.