Who it's for
For developers who ship an LLM app or an AI agent, and for security and product people who review one. You need to read a YAML file and run a command line. Lesson 4 uses Node.js 22.22.0 or newer for Promptfoo and Python for garak and PyRIT, which asks for 3.11 to 3.14.
Lessons
- 1Prompt injection: direct and indirect attacks, and designs that limit the damagePrompt injection hides instructions in text an AI reads. See direct and indirect attacks, why no filter stops them and the designs that limit the damage.
- 2LLM jailbreaks and system prompt leaks: what they are and what stops themA jailbreak attacks a model's safety rules, an injection attacks your app and a leak exposes hidden prompts. See how each works and what to defend.
- 3The OWASP Top 10 for LLM applications: each risk in one line, with a first fixThe OWASP Top 10 for LLM applications, 2026 edition: each of the ten risks in one plain line with a first fix, and how to use the list as a checklist.
- 4Red team your own LLM app: Promptfoo, garak and PyRIT, what to test and how to read the resultsAttack your own LLM app before someone else does. Set up Promptfoo, see garak and PyRIT commands, pick what to test and read the results.
Frequently asked questions
Is this AI security course free?
Yes. Every lesson is free to read. Running the scans in lesson 4 calls model APIs, and those providers may bill for their use.
What is prompt injection?
It is text that makes a model follow an instruction its developer did not intend, often hidden in a page, an email or a file the model reads for a task. Lesson 1 shows real examples and the designs that limit the damage.
Do I need a security background to follow the course?
No. Each lesson defines its terms where it first uses them. You do need to be comfortable reading a config file and running a command.
Does the course teach people to attack other systems?
No. The lessons describe attack families at the level of the vendors' own posts and name no working jailbreak. Lesson 4 tests your own app, and it advises a staging copy.
Which OWASP list does lesson 3 cover?
The 2026 edition, published on 4 August 2026. OWASP lists the 2025 edition as archived, and the lesson shows how the numbers moved between them.
What should I learn after this course?
The AI evals course is next. Its first lesson builds a test set from real failures, and the same habit turns a red team finding into a test you run on every change.