Defending AI Agents
עברית Join waitlist

Free course · for data scientists · in preparation

DefendingAI agents

Agent security is a statistics problem. Build every defence yourself on a laptop, then learn what it becomes at fifty million calls a day.

Calls10,000Alerts101Attacks1Real0.98%
01The problem

You already know the hard part.

The central problems of securing AI agents have statistical twins. The course supplies the security half.

01

Rare events

Attacks are rare. How often an alert is right is set by the base rate, not by how good the detector looks on a balanced test set.

02

Operating points

Every threshold spends a false-alarm budget. You choose where to spend it, and measure it where the system acts.

03

Distribution shift

A detector tested on prose meets JSON, logs, diffs and SQL in production, and behaves differently.

04

Counterfactuals

Will a new policy help? Replay it over last month's traffic and run it in shadow before you enforce it.

02Try it

Four sliders. One uncomfortable number.

A detector that catches 99% of attacks and flags 1% of harmless calls sounds excellent. Move the sliders and see how many of its alerts are real.

Alerts that are real attacks
1%

Alerts per day
Real attacks among them
Real attackFalse alarm
03What you build

Every component, with your own hands.

No security product, commercial or open-source, is used or taught. You build a miniature agent gateway with general-purpose open tools, one component per module.

  1. M01A small tool-calling agent, and the attack that breaks it
  2. M03A gateway that intercepts every tool call before it runs
  3. M04Prompt-injection detectors: patterns and a fine-tuned classifier
  4. M05A retrieval store and memory that record where every entry came from
  5. M06A membership-inference attack, and a differentially private release
  6. M07Thresholds set from a false-positive budget, with a confidence bound
  7. M08An evaluation harness on data shaped like real tool calls
  8. M09A red-team harness and an adaptive attacker, with honest reports
  9. M10Behavioural baselines and sequential detectors
  10. M11Taint tracking, and an agent redesigned so injected text cannot act
  11. M12Short-lived scoped credentials, a sandbox and a kill switch
  12. M13A policy engine that allows, refuses, or holds for a person
  13. M14Model and tool checks before anything is trusted
  14. M15Personal-data detection, redaction and erasure
  15. M16A signed, tamper-evident log, replay, and off-policy estimates
  16. M17A policy learner that a patient attacker cannot train
  17. M18An incident runbook, tested on a recorded attack
04Scale

Build it small. Reason about it at scale.

Every module ends with what the same component becomes at millions of calls a day, thousands of agents and many teams, worked out from your own measurements.

On your laptop
40ms

Your detector scores one tool call in 40 milliseconds. You measured it, you understand every line, and it runs in 8 GB of memory with no GPU.

At 50 million calls a day
23cores

The same detector keeps about 23 cores busy around the clock. Where does it run? What happens to a call when it is slow or down? Who reviews its alerts?

05Curriculum

Twenty modules and a capstone.

Each module ends at a measurement you produce and defend, not at a page you have read. About 134 hours, self-paced, in English and Hebrew.

I

Foundations

  1. 00Orientation: why agent security is a statistics problem
  2. 01Setting up your lab and your toy agent
  3. 02Security fundamentals for data people
  4. 03Anatomy of an agent and its attack surface
II

Attacks

  1. 04Prompt injection and jailbreaks
  2. 05Poisoning, backdoors and agent memory
  3. 06Privacy attacks and differential privacy
III

Measurement

  1. 07Detectors are classifiers: base rates, budgets, operating points
  2. 08Evaluation hygiene and distribution shift
  3. 09Adversarial robustness and red-teaming
  4. 10Behavioural and sequence anomaly detection
IV

Enforcement

  1. 11Secure by design: architectures injected text cannot steer
  2. 12Identity, least privilege and containment
  3. 13From score to decision: policy, holds and humans
  4. 14The supply chain: models, packages and tools
  5. 15Data protection: personal data, redaction, erasure
V

Operations

  1. 16Evidence: audit trails, replay and counterfactual evaluation
  2. 17Learning policy from traffic, safely
  3. 18Monitoring and incident response for agents
  4. 19Governance, audit and regulation for engineers
CapstoneBuild it, then break someone else's.Your own design and gateway for a new scenario, run against a hidden attack suite; a scale memo; and a red-team report on another learner's work.
06Certificate

Free to learn. Paid to certify.

The whole course is open. The only paid part is the final exam, which a person reviews.

Free

The courseNo account needed to read.

  • Every lesson, build and test
  • English and Hebrew
  • A starter kit and automated checks for each module
  • Yours to keep and revisit
Paid

Final exam and certificateOptional. Price announced at launch.

  • Your capstone, reviewed personally
  • Detailed written feedback
  • A signed certificate that anyone can verify
  • A public page linking your reviewed work, if you choose
07Questions

Frequently asked.

Why this course?

We reviewed the 26 university courses on machine-learning, LLM and agent security whose schedules are public. None teaches runtime enforcement, evidence or operations for AI agents as a subject. This course is built around them, and around evaluation at production scale.

Do I need a security background?

No. The course assumes Python, probability and machine learning, and teaches the security from the ground up.

What do I need to run it?

A laptop with 8 GB of memory, running macOS, Windows (with WSL 2) or Linux. No GPU is required. Installing Docker and setting up the lab is a module of its own.

Which products does it teach?

None. You build every component yourself with open, general-purpose tools, and wherever a tool is chosen the lesson names an alternative.

Is it really free?

Yes. Every lesson, build and automated check is free. Only the final exam, which a person reviews, and the certificate that follows are paid.

In which languages?

English and Hebrew. Code, commands and tools stay in English in both.

When does it open?

It is in preparation. Join the waitlist to hear when the first modules are published.

Join the
waitlist

You are on the list. We will write when the first modules are out.

That does not look like an e-mail address. Check it and try again.

Too many attempts from your network. Please try again in an hour.

The list could not be reached. Please try again, or write to shimon@defendingaiagents.com.

08  Waitlist

One e-mail when the first modules are published, and occasional notes on how the course is going. Your address is used only for this course and is never shared. To be removed, write to shimon@defendingaiagents.com.