Agents and Production in AI Security & Guardrails

Agents and Production is a chapter of the free AI Security & Guardrails tutorial with 4 lessons: Agentic Risks, RAG & Vector Weaknesses, Supply Chain and Unbounded Consumption & Monitoring. Plan on about 140 minutes. It has 14 exercises you run and check in your browser.

What each lesson covers:

  • Agentic Risks: A memory planted in one session leaks data in the next, a subagent obeys a ticket, and a loop runs 500 tool calls. Add memory provenance, handoff checks and a step cap that honest tasks fit under.
  • RAG & Vector Weaknesses: Poisoned community posts answer policy questions and a vector search returns another customer's ticket. Quarantine untrusted documents at ingestion and filter every search by tenant.
  • Supply Chain: An MCP tool description tells the agent to email conversations out, and a model invents a package name an attacker registered. Pin MCP servers to reviewed descriptions and check packages before install.
  • Unbounded Consumption & Monitoring: A 60,000-token message, a request burst, a spend run-up and a runaway loop. Size per-user limits above real use, check cost before the call, and alert on attack signatures in traces.

Before you start, it helps to have finished Securing AI Features, because these lessons build on it.

When you finish, continue with Securing AI Coding Agents.

Lessons in this section

  1. Agentic Risks

    A memory planted in one session leaks data in the next, a subagent obeys a ticket, and a loop runs 500 tool calls. Add memory provenance, handoff checks and a step cap that honest tasks fit under.

    • Explain how memory poisoning attacks a later session
    • Accept memories by source, not by content
    • Stop a subagent acting as a confused deputy
    • Size a step cap above honest multi-step tasks
  2. RAG & Vector Weaknesses

    Poisoned community posts answer policy questions and a vector search returns another customer's ticket. Quarantine untrusted documents at ingestion and filter every search by tenant.

    • Explain why vector similarity ignores ownership
    • Filter retrieval by tenant in the query
    • Quarantine documents from unapproved sources
    • Treat wrong answers as harm
  3. Supply Chain

    An MCP tool description tells the agent to email conversations out, and a model invents a package name an attacker registered. Pin MCP servers to reviewed descriptions and check packages before install.

    • Explain why MCP tool descriptions are instructions
    • Allow-list MCP servers and pin reviewed descriptions
    • Recognise slopsquatting and typosquatting
    • Check package names and versions before an agent installs them
  4. Unbounded Consumption & Monitoring

    A 60,000-token message, a request burst, a spend run-up and a runaway loop. Size per-user limits above real use, check cost before the call, and alert on attack signatures in traces.

    • Name the four kinds of unbounded consumption
    • Size rate, token, spend and step limits from real traffic
    • Estimate cost before a model call
    • Alert on attack signatures in traces