GuideAdvanced
Agent Security And Sandboxing
Learn to secure an agent that takes real actions with tools over a system. This guide covers an agent's threat model, direct and indirect prompt injection, the tool contract and least privilege, sandboxing tool execution, permission models and human-in-the-loop, input and output guardrails, and secrets handling and blast radius. The case that runs through the whole guide is a Reservo agent (a coworking room-booking backend) with tools like `search_rooms`, `book_room`, and `cancel_booking`. You come out knowing how to design an agent that can't be manipulated into causing harm or leaking data, even when the model or the user input is hostile. All the security engineering — the tool validator, the sandbox, the permission gate, the guardrails, the audit log, and the injection demo with its defense — actually runs with Python 3.14 (stdlib); the LLM's decision is presented as a concept, with realistic examples.
- 64
- lessons
- 8
- modules
- English · Spanish
- available in
- Yes
- certificate
- Free
- access
Outcomes
What you'll be able to do
- Understand why an agent with tools is a new attack surface, using the OWASP LLM Top 10 framework (prompt injection, insecure output handling, excessive agency)
- Defend against direct and indirect prompt injection by treating every tool output and every external piece of data as untrusted, never as an instruction
- Design each tool's contract with least privilege: what it receives, what it returns, and an allowlist of actions that rejects anything not permitted
- Isolate tool execution with sandboxing: a confined `subprocess` with resource limits, a timeout, no network access, and a temporary directory
- Implement permission models and human-in-the-loop: auto-allow what's safe, ask for confirmation on what's risky, forbid what's dangerous, with an audit log of every tool call
- Build input and output guardrails: validate the arguments an agent passes to a tool, and sanitize what a tool returns before it re-enters the context
- Handle secrets with least-privilege credentials per tool, and limit the blast radius of a compromised agent
- Harden a complete agent in the final project and validate it with a red-team test — a battery of executed attacks — that the defenses block
Before you start
What you need to bring
It's for you if...
- Devs building an agent with tools who need to make sure a hostile input can't turn into a destructive action
- Teams evaluating how to give an agent autonomy without exposing credentials, data, or irreversible actions
- Devs who already know agent fundamentals and want the specific security slice, not another general agents course
- Engineers preparing for interview questions about AI agent security: prompt injection, excessive agency, sandboxing
Requirements and materials
- Python 3.14 and basic knowledge of agents with tool calling
- You don't need to have built a full agent before, though knowing the agentic engineering ecosystem helps
- No real calls to any LLM API in this guide: all the security engineering runs with Python stdlib
Content
The syllabus, module by module
Open any of them to see its lessons.
- Module 1: Why Agent Security
- From talking to acting: why an agent with tools is dangerous
- An agent's threat model
- Excessive agency
- The OWASP LLM Top 10 as a framework
- How this differs from classic app security
- Anatomy of an incident: how an agent attack chains together
- Mini-project: a vulnerable Reservo agent
- Module 2 Introduction: Prompt Injection
- What prompt injection is
- Direct injection: when the attacker is the user
- Indirect injection: the poisoned data
- Why the LLM doesn't separate instructions from data
- Prompt defenses: delimiters and instruction hierarchy
- Why no prompt defense is enough: you have to limit agency
- Mini-project: inject and defend
- Module 3 Introduction: the tool contract and least privilege
- A tool's contract and its JSON Schema
- Least privilege: only the tools you need
- Narrow tools vs. a too-powerful tool
- Separating reads from writes and marking the destructive
- The tool allowlist and safe dispatch
- Designing a safe tool: bounding `run_query`
- Mini-project: a least-privilege registry
- Module 4 Introduction: sandboxing tool execution
- Why confine a tool's execution
- Subprocess: isolating from the agent's process
- Limits with `resource`: CPU and memory
- The timeout that kills a hung process
- No network and an isolated temp dir
- What a sandbox protects and what it does not
- Mini-project: a sandboxed code tool
- Module 5 Introduction: permission models and human-in-the-loop
- Not all actions are equal: reversible vs destructive
- The three levels: auto / ask / deny
- Human-in-the-loop: the approval gate
- Capability-based permissions, not ambient access
- The audit log of every tool call
- Designing an agent's permission policy
- Mini-project: a permission-gated agent
- Module 7 Introduction: secrets, isolation, and blast radius
- Secrets outside the prompt: the model never sees them
- Minimal-scope credentials per tool
- Network isolation and host allowlists
- The blast radius and how to shrink it
- Defense in depth: the layers together
- Monitoring and anomaly detection on the audit log
- Mini-project: shrink the blast radius
Common questions
What people usually ask
No limit. It's a free guide: come in whenever you like, as often as you like.
No. Modules run from easier to harder, but you can jump to the one you need. Progress is saved per lesson.
Whatever is needed is listed under “What you need to bring”, above. If nothing is listed there, you can start from zero.
In the Club's WhatsApp group, and every two weeks there's a live with an instructor where questions get worked through.
Yes. It's issued automatically once you finish every lesson, with a verifiable code you can share on LinkedIn.
Start whenever you like
What students say
These reviews are from enrolled students who completed at least 50% of the course. We moderate reviews only on content grounds (spam, offensive language, personal data), never for being critical or negative.
No approved reviews yet.
Be the first to share your experience!