Study notes · three weeks · 3–4 h a week
Agent Security
An agent that can act can be turned. This path starts from the OWASP agentic risk list, then maps each risk to concrete Azure controls: shields on inputs and tool output, real identities for agents, and automated red-teaming.
The core material
| Resource | Role | Use it for |
|---|---|---|
| OWASP Top 10 for Agentic Applications | Threat model | The ten agent-specific risks, released December 2025 |
| MCP Security Best Practices | Protocol security | Confused deputy, token passthrough, tool poisoning and local server risks |
| Prompt Shields | Azure control | Detect direct and indirect prompt injection, including in agent tool responses |
| Microsoft Entra Agent ID | Azure control | Identities, blueprints, Conditional Access and governance for agents |
| AI Red Teaming Agent | Azure testing | PyRIT-based scans with agentic risk categories and an attack success rate |
- No Educative pick here. I didn't find an Educative course on agent security; the vendor and OWASP material is stronger.
01 / Week 1
The agentic threat model
Learn the ten risks that are specific to agents, and how MCP's own security guidance addresses several of them.
| ID | Risk |
|---|---|
| ASI01 | Agent goal hijack |
| ASI02 | Tool misuse and exploitation |
| ASI03 | Identity and privilege abuse |
| ASI04 | Agentic supply chain compromise |
| ASI05 | Unexpected code execution |
| ASI06 | Memory and context poisoning |
| ASI07 | Insecure inter-agent communication |
| ASI08 | Cascading failures |
| ASI09 | Human-agent trust exploitation |
| ASI10 | Rogue agents |
Read (~3 h)
CheckpointFor one agent you run, rank the ten risks by exposure and name the single change that would cut the top one most.
02 / Week 2
Controls: shields, identity, least privilege
Put guards on what goes into the model and give each agent its own identity with only the access it needs.
Inputs and tool output (~1.5 h)
- Prompt Shields: user prompt attacks, document attacks, and scanning agent tool responses (preview)
- Turn on document-attack detection and spotlighting for one retrieval path, and log in annotate mode before you block.
Identity and access (~2 h)
- What are agent identities
- Plan your agent identity architecture
- Conditional Access for agents
- Split one broad tool into read and write tools, require approval on the write path, and mark each with honest MCP annotations.
Remember: A clean shield result doesn't mean the input is safe. Shields cut risk; least privilege limits the damage when one gets through.
CheckpointYour agent runs as its own Entra identity, cannot call any write tool without approval, and flags injected text in a retrieved document.
03 / Week 3
Red-team the agent before launch
Attack your own agent with automated scans, measure the success rate, fix, and re-run.
Do (~3 h)
- AI Red Teaming Agent concepts: agentic categories: prohibited actions, sensitive data leakage, task adherence, indirect prompt injection
- Run a cloud scan: agentic categories are cloud-only, in selected regions
- PyRIT: the open-source engine underneath, for custom attacks
- Run against a non-production copy with mock tools, never against live systems.
CheckpointYou have a before-and-after attack success rate for indirect prompt injection on one agent.
Capstone
Harden one real agent. Done when every line holds:
- A written threat model maps the agent to the OWASP agentic risks
- Prompt Shields scan user input and retrieved documents
- The agent has its own identity with least-privilege access
- Destructive tools need human approval and are annotated as destructive
- A red-team scan runs before each release and its success rate is tracked
- Secrets never appear in prompts, tool arguments or traces