Skip to content
1Claw Academy
← Curriculum
Beginner

The AI Agent Threat Model

What actually breaks when an LLM can act: injection, the lethal trifecta, and OWASP ASI01-10.

By the end of this track

You’ll be able to audit any agent design against the lethal trifecta and OWASP ASI01–10, and name the control that answers each risk.

14 lessons~31 min42 questions
Start → Why agents break classic security assumptions
  1. 1Why agents break classic security assumptionsSee exactly which assumptions traditional application security relies on, and which ones a language model violates.
  2. 2Prompt injection, direct and indirectDistinguish the user-supplied attack from the far more dangerous one that arrives inside content the agent reads.
  3. 3Lab: defeat your own defensesLabBuild the two defenses everyone reaches for first, break both in a few characters, and see exactly why the fix is not at the prompt layer.
  4. 4The lethal trifectaUse Simon Willison's three-capability model to decide whether a given agent configuration is exploitable at all.
  5. 5Lab: send data out without calling anythingLabEmit one line of markdown and trace what the client does with it.
  6. 6OWASP Top 10 for Agentic ApplicationsWalk the ASI01-ASI10 categories so you have a shared vocabulary for agent risk.
  7. 7The context window as an exfiltration surfaceTreat everything the model can see as already disclosed, and design credential handling around that.
  8. 8Lab: a secret you pasted 37 turns agoLabPut a credential into a conversation, run it forward, and check whether it is still reachable at the end.
  9. 9Excessive agency and the confused deputyUnderstand why an agent's privileges, not its intentions, determine how bad an attack gets.
  10. 10Memory poisoning, multi-agent risk, and supply chainFollow the attacks that persist across sessions and spread between agents.
  11. 11Lab: plant something in session one, collect in session twoLabWrite to agent memory as an attacker, then open a clean session as a different user and watch it arrive.
  12. 12Designing the defense: the control plane patternAssemble the whole track into an architecture, and see the shape 1Claw implements.
  13. 13Lab: audit real agents in the wildLabFetch 1Claw's live, public agent directory and run the trifecta audit method from this track against whatever is actually registered right now.
  14. 14Capstone: audit an agent fleetCapstoneApply the whole track to three real agents: find the exploitable one, rank the risk, and say what you would change first.