Course description
Securing Campus AI Agents teaches CIOs, CISOs, security engineers and the teams deploying AI agents to find and fix the risks that appear when an agent can read the SIS, LMS or CRM and take actions. You will learn the threat classes from the OWASP Top 10 for LLM Applications 2025 and OWASP's agentic guidance (direct and indirect prompt injection, excessive agency, sensitive information disclosure, data and model poisoning through retrieved documents, improper output handling and unbounded consumption) and map them to MITRE ATLAS and NIST AI 600-1. In six hands-on labs you attack a sandboxed sample agent that holds only synthetic records, then fix each finding with least-privilege tool scopes, role-based access, human approval for consequential actions, egress allowlists, input and output filtering and audit logging, and prove the fix by re-running the attack. The course ends with a threat model, launch checklist and incident playbook for an agent your campus plans to deploy. Last verified 2026-11-03.
About this course
An agent that can read the student information system, the learning management system or the CRM, and can send email or update records, acts with whatever access it has been given. A planted sentence in a web page, a shared document or an email can redirect it. This course teaches IT and security teams to find and fix those risks before launch. You will learn the threats from the primary sources, the OWASP Top 10 for LLM Applications 2025, OWASP's agentic threat guidance, NIST AI 600-1, the NIST AI Risk Management Framework, MITRE ATLAS and the joint guidance Deploying AI Systems Securely, then attack a sandboxed sample agent that holds only synthetic records, fix every finding with controls that do not depend on the model behaving well, and leave with a threat model, a launch checklist and an incident playbook. The principles are vendor-neutral; where the course shows a control on ibl.ai, it links the live documentation.
What you will be able to do
- Name the threat classes specific to tool-using agents (direct and indirect prompt injection, excessive agency and over-broad tools, sensitive information disclosure, data and model poisoning through retrieved documents, improper output handling and unbounded consumption) and map each to the OWASP Top 10 for LLM Applications 2025, OWASP's agentic guidance and MITRE ATLAS.
- Attack a sandboxed sample agent that holds only synthetic records, and record each finding with its evidence, reproducibility and framework mapping.
- Fix excessive agency with least-privilege tool scopes that run as the user, role-based access and human approval for consequential actions, all enforced outside the model.
- Contain what still gets through with egress allowlists, sandboxed execution, input and output filtering and spend limits, and prove each fix by re-running the attack.
- Design audit logging that separates requested from executed actions, reconstruct an attack from the logs, and write the alerts that would have caught it.
- Write a pre-launch threat model, launch checklist and incident playbook for a campus agent, aligned with the NIST AI RMF, NIST AI 600-1 and NIST SP 800-61 Rev. 3.
Who this course is for
Roles: CIOs, CISOs, security engineers, enterprise architects, identity and network teams, and the application teams deploying AI agents that can read the SIS, LMS or CRM and take actions such as sending email or updating records.
Institutions: colleges, universities and systems that are building, buying or piloting AI agents connected to institutional systems.
Before you start: familiarity with identity and access management, network controls and logging. For the hands-on labs you need a non-production workspace on an agent platform you are authorized to test; a simulated mode lets anyone complete them with any chat-based agent. All lab data is synthetic and supplied in the course.
Format
Time: about 10 to 12 hours, self-paced. Level: intermediate to advanced. Hands-on: six labs on a sandboxed sample agent, with an AI tutor that coaches each step from the output you paste.
Structure: a Start here section, four content sections of readings, worked examples, templates and hands-on labs, each ending in an AI assessment, and a capstone in which you write a threat model and launch checklist for one agent your campus plans to deploy, followed by a reading list.
Grading: the four section AI assessments count for 60 percent of the grade and the capstone assessment for 40 percent. The pass mark is 70 percent.
Currency
Last verified 2026-11-03 against the OWASP Top 10 for LLM Applications 2025, OWASP Agentic AI: Threats and Mitigations (version 1.1, December 2025), the OWASP Top 10 for Agentic Applications for 2026, NIST AI 600-1, NIST AI 100-2e2025, NIST SP 800-61 Rev. 3, MITRE ATLAS release 2026.10 and the ibl.ai documentation.
This field changes quickly. OWASP, NIST and MITRE revise their guidance often, and new attack techniques appear between releases. Check the current versions before relying on any page or template, and test only systems you are authorized to test. This course is training, not a security assessment of your systems.
Outline
Section 0 · Start here
- 0.1 Welcome and orientation
Section 1 · Name the threats that tool-using agents add
- 1.1 From chatbot to agent
- 1.2 Prompt injection and the frameworks you will map to
- 1.3 Section 1 assessment
Section 2 · Attack a sandboxed sample agent
- 2.1 Lab setup and rules of engagement
- 2.2 Four attack labs
- 2.3 Section 2 assessment
Section 3 · Fix each finding with layered controls
- 3.1 Least privilege and human approval
- 3.2 Containment, filtering and logging
- 3.3 Section 3 assessment
Section 4 · Threat-model, launch and respond
- 4.1 Threat-model before launch
- 4.2 Respond when something goes wrong
- 4.3 Section 4 assessment
Section 5 · Capstone and wrap-up
- 5.1 Capstone: threat model and launch checklist for your campus agent
- 5.2 Capstone assessment
- 5.3 Reading list and next steps