AI Agent Security
AI-Agents shippen die nicht gekapert werden können.
Security-Engineers und AI-Builder die Agents produktiv einsetzen.
Du shipst AI-Agents in Produktion. Oder bist kurz davor. So oder so: die Anzahl der Angriffsflächen hat sich gerade verdoppelt, und 80 % der Guidance im Internet ist entweder theoretisch, veraltet (pre-GPT-4o), oder speziell über das Brechen von Agents — nicht ihre Verteidigung. Dein Vorstand hat gerade von Prompt Injection gehört. Dein PM hat gerade ein Agent-Feature versprochen. Du brauchst das Defensive-Playbook.
Prompt Injection ist kein Bug — es ist eine Konsequenz davon wie LLMs Kontext verarbeiten. Die einzige sichere Haltung ist architektonisch: behandle abgerufenen Content als Daten, constrain Tool-Zugriff, gate sensitive Actions hinter Human-Approval, monitore post-hoc auf Anomalien. Dieser Track kodiert diese Haltung als sieben spielbare Missionen gegen einen simulierten verwundbaren Agent-Stack.
- M-001
Block prompt injection: input sanitization, canary tokens, output validation
AI assistant concatenates raw user input into LLM context. Attacker injects 'Ignore all instructions' → model leaks API key. Add input sanitization, move secrets, add canary + output validation.
⏱️ 15 min⚡ 280 XP🎯 7 goalsLaunch → - M-001
Incident Response: analyze logs to detect breach
Your auth.log shows suspicious login patterns. Analyze logs: identify suspicious IPs, count failed attempts, detect breach, generate report.
⏱️ 16 min⚡ 280 XP🎯 6 goalsLaunch → - M-001
GDPR Data Minimization: reduce data collection to essential only
Your user schema collects excessive data (phone, address, DOB, IP, user-agent). Reduce to essential fields: implement data retention policy, right-to-be-forgotten, update privacy policy.
⏱️ 17 min⚡ 290 XP🎯 6 goalsLaunch → - M-001
Recognize attack patterns under fire
The attacker is live. Spot the pattern, deploy the countermeasure, level up.
⏱️ 18 min⚡ 300 XP🎯 4 goalsLaunch → - M-002
Apply least privilege to AI agent tools: path allow-lists, remove execShell, domain whitelist
AI coding assistant has unrestricted readFile, writeFile, execShell, httpFetch. One injection = RCE. Apply least privilege: path allow-lists, confirmation codes for writes, remove shell, domain whitelist.
⏱️ 14 min⚡ 260 XP🎯 7 goalsLaunch → - M-002
Detect the real alert from the noise
Filter log noise, triage the incident, trigger the right playbook.
⏱️ 12 min⚡ 250 XP🎯 4 goalsLaunch → - M-002
Translate NIS2 into engineering controls
Map NIS2 requirements to concrete technical controls. No more paragraph-reading.
⏱️ 15 min⚡ 280 XP🎯 5 goalsLaunch → - M-002
Supply chain security — trust no one
Your dependencies are attack vectors. Secure the supply chain.
⏱️ 20 min⚡ 320 XP🎯 4 goalsLaunch → - M-003
Sanitize LLM output: DOMPurify, Markdown renderer hardening, Content-Security-Policy
AI chat renders raw LLM output as innerHTML. Indirect prompt injection via knowledge-base doc causes stored XSS. Add DOMPurify, harden Markdown renderer, add CSP, enforce structured output.
⏱️ 13 min⚡ 240 XP🎯 7 goalsLaunch → - M-003
Triage under pressure — 03:00 AM wake-up call
PagerDuty goes off at 03:00. You have 5 minutes to triage. No panic.
⏱️ 13 min⚡ 260 XP🎯 4 goalsLaunch → - M-003
DORA compliance — ICT risk management
DORA requires financial institutions to manage ICT risk. Translate to engineering controls.
⏱️ 18 min⚡ 300 XP🎯 4 goalsLaunch → - M-003
Social engineering defense — humans are the weakest link
The most sophisticated attack targets humans. Defend against social engineering.
⏱️ 21 min⚡ 330 XP🎯 4 goalsLaunch → - M-004
LLM API cost protection: rate limiting, auth, token budgets, circuit breaker
$47k OpenAI bill in 4 hours from anonymous cost-DoS. Add IP rate limiting, authentication, server-side token cap, per-user daily budget, and a global circuit breaker at $500/day.
⏱️ 12 min⚡ 250 XP🎯 7 goalsLaunch → - M-004
Containment playbooks — stop the bleeding
The breach is live. Isolate systems, block the attacker, stop the damage.
⏱️ 14 min⚡ 270 XP🎯 4 goalsLaunch → - M-004
EU AI Act compliance — technical obligations
EU AI Act imposes technical obligations on AI systems. Implement the controls.
⏱️ 19 min⚡ 310 XP🎯 4 goalsLaunch → - M-004
Ransomware defense — prepare for the worst
Ransomware is inevitable. Prepare, detect, respond.
⏱️ 22 min⚡ 340 XP🎯 4 goalsLaunch → - M-005
Forensics without destroying evidence
The breach is contained. Investigate without destroying evidence. Chain of custody matters.
⏱️ 15 min⚡ 280 XP🎯 4 goalsLaunch → - M-005
DSGVO Art. 32 compliance — state of the art
DSGVO Art. 32 requires 'state of the art' security. Implement the controls.
⏱️ 20 min⚡ 320 XP🎯 4 goalsLaunch → - M-005
ML security — defend the model
ML models are attack surfaces. Defend against adversarial ML.
⏱️ 23 min⚡ 350 XP🎯 4 goalsLaunch → - M-006
Incident recovery — restore and verify
The breach is contained. Restore services from backups and verify system integrity.
⏱️ 16 min⚡ 290 XP🎯 4 goalsLaunch → - M-006
Evidence collection — audit ready
Compliance is useless without evidence. Collect and organize for audit.
⏱️ 21 min⚡ 330 XP🎯 4 goalsLaunch → - M-006
Red teaming — think like the attacker
To defend, you must attack. Think like the attacker to find vulnerabilities.
⏱️ 24 min⚡ 360 XP🎯 4 goalsLaunch → - M-007
Root cause analysis — find the why
The incident is resolved. But why did it happen? Find the root cause and recommend remediation.
⏱️ 17 min⚡ 300 XP🎯 4 goalsLaunch → - M-007
SOC2 Type II compliance — security controls
SOC2 Type II requires documented security controls. Implement and evidence.
⏱️ 22 min⚡ 340 XP🎯 4 goalsLaunch → - M-007
Blue teaming — defend the fortress
The attacker is coming. Defend the fortress. Detect, respond, recover.
⏱️ 25 min⚡ 370 XP🎯 4 goalsLaunch → - M-008
Incident post-mortem — learn and improve
The incident is over. Document what happened, identify lessons learned, and create action items.
⏱️ 18 min⚡ 310 XP🎯 4 goalsLaunch → - M-008
ISO27001 compliance — ISMS implementation
ISO27001 requires an Information Security Management System. Build it.
⏱️ 23 min⚡ 350 XP🎯 4 goalsLaunch → - M-008
Purple teaming — red + blue collaboration
Red and blue teams working together. Collaborative security testing.
⏱️ 26 min⚡ 380 XP🎯 4 goalsLaunch → - M-009
Incident response playbooks — ready to run
When the alarm goes off, you don't think. You execute. Build the playbooks.
⏱️ 19 min⚡ 320 XP🎯 4 goalsLaunch → - M-009
Third-party risk management
Your security is only as strong as your weakest vendor. Manage third-party risk.
⏱️ 24 min⚡ 360 XP🎯 4 goalsLaunch → - M-009
Threat intelligence — know your enemy
Intelligence-driven security. Know your enemy before they attack.
⏱️ 27 min⚡ 390 XP🎯 4 goalsLaunch → - M-010
Incident communication — transparent and timely
The incident is happening. Communicate transparently. Trust is on the line.
⏱️ 20 min⚡ 330 XP🎯 4 goalsLaunch → - M-010
OSINT — open source intelligence
Public information is intelligence. Gather, analyze, act.
⏱️ 28 min⚡ 400 XP🎯 4 goalsLaunch → - M-011
Incident drills — practice makes perfect
Playbooks are useless if you haven't practiced. Run the drills and improve.
⏱️ 21 min⚡ 340 XP🎯 4 goalsLaunch →
Concrete outcomes. No lecture notes.
- 01Ein LLM-Gateway mit Input-Sanitisation, Output-Filterung und Rate-Limiting
- 02Eine sandboxed Tool-Execution-Layer — dein Agent kann Funktionen aufrufen aber nichts exfiltrieren
- 03Ein Threat-Model-Dokument für deinen spezifischen Agent (Template + echte Beispiele)
- 04Prompt-level Guardrails die der OWASP Top 10 für LLMs widerstehen
- 05Ein Audit-Log stark genug für die Logging-Requirements des EU AI Act
- 06Ein Human-in-the-Loop-Flow für High-Impact-Actions, Friction kalibriert zum Risiko
- ▸Produkt-Teams die LLM-Agents an Kunden shippen
- ▸Security-Engineers die eine AI-Roadmap übergestülpt bekamen
- ▸Startups die auf OpenAI, Anthropic oder lokalen LLMs für regulierte Kunden bauen
- ▸Technische Leads die 'sind wir AI-Act-ready?' beantworten müssen
Mappt auf EU AI Act Artikel 9 (Risikomanagement), 12 (Aufzeichnungen), 14 (menschliche Aufsicht) und 15 (Genauigkeit & Robustheit). Ship mit AI-Act-Technikdokumentations-Template das du als Annex-IV-Evidence submitten kannst. Berührt auch OWASP Top 10 für LLMs und NIST AI RMF.
Wir waren kurz davor einen Agent auf Support-Tickets zu shippen. Hab die Prompt-Injection-Sandbox und die Threat-Modeling-Mission gefahren. Drei Bypasses gefunden die wir in Code-Review nie erwischt hätten. Release verzögert um eine Woche. Hat sich gelohnt.
Defender III — AI Security
Schließe alle 6 AI-Agent-Security-Missionen ab + bestehe die Live 'verteidige einen Agent für 60 Minuten'-Capstone (Red Team AI Co-Player aktiv).
- ✓W3C Verifiable Credential — AI-Security-Spezialisierung
- ✓EU-AI-Act-Technikdokumentations-Template (Annex-IV-Starter)
- ✓Jährliche Rezertifizierung für Graduates kostenlos
- ✓Listing im öffentlichen ClawGuru-AI-Security-Defenders-Directory (opt-in)
Questions we already got.
Lehrt das Jailbreaking-Techniken?+
Nein. Das ist strikt defensiv. Wir zeigen wie Angreifer denken — aber jede Mission hat als Ziel eine Mitigation zu shippen, keinen Bypass.
Ist der Content vendor-neutral?+
Ja. Die Guardrails funktionieren egal ob du auf OpenAI, Anthropic, Google oder lokal Llama/Qwen/aya bist. Wo vendor-spezifische Features wichtig sind (Moderation-APIs, Function-Calling-Quirks), rufen wir sie explizit.
Was ist mit Agent-Frameworks (LangChain, CrewAI, Agentic SDK)?+
Generisch abgedeckt — die Angriffsfläche ist im Pattern, nicht im Framework. Wir inkludieren Beispiele für die verbreitetsten Patterns Stand 2026.
Wie aktuell ist das?+
Quartalsweise refreshed. Die CVE-Time-Machine-Integration (wenn sie shipped) generiert automatisch neue Missionen für frische AI-bezogene CVEs — du siehst sie 'hot' markiert im Track.
Wöchentlicher Security-Report
Kritische CVEs, Fix-Anleitungen und Hardening-Tipps — kostenlos, jede Woche.