c0c0n is a 19 years old platform that is aimed at providing opportunities to showcase, educate, understand and spread awareness on Information Security, data protection, and privacy...
As organizations rapidly integrate Large Language Models (LLMs) into production systems, AI is no longer confined to passive text generation. Modern deployments increasingly involve autonomous AI agents that reason, make decisions, and invoke tools and APIs via standardized mechanisms such as the Model Context Protocol (MCP). While this evolution unlocks powerful new capabilities, it also introduces security risks that fundamentally differ from traditional application and cloud security models.
This comprehensive, hands-on three-day training provides a deep, practical exploration of attacking and defending AI-driven systems across their full lifecycle—from standalone LLM applications, to autonomous agents, to production-scale tool ecosystems. The course is designed for security professionals who must understand not only how AI systems work, but how they fail under adversarial conditions.
The training begins by reframing LLMs as probabilistic decision engines, not deterministic software components. Participants learn why traditional security assumptions break down when applied to prompt-based systems and how trust boundaries shift from code to prompts, context, and model outputs.
Through a series of hands-on labs, participants attack and defend LLM applications using real-world techniques aligned with the OWASP Top 10 for LLM Applications. Topics include prompt injection (direct and indirect), prompt extraction and reflection attacks, jailbreaking techniques, sensitive data leakage, and Retrieval-Augmented
Generation (RAG) poisoning. Participants build vulnerable systems, exploit them, and then implement layered defenses such as prompt hardening, output validation, semantic checks, and access controls. By the end of Day 1, attendees develop a critical mindset: every input, context source, and output from an LLM must be treated as untrusted.
Day 2 shifts focus from LLMs as responders to AI agents as autonomous actors. Participants explore how modern agent frameworks enable LLMs to plan, reason, and invoke tools with real-world side effects. The course examines how autonomy introduces new failure modes, including excessive agency, unsafe tool invocation, decision manipulation, and workflow abuse.
Participants build AI agents using common agent patterns and then adopt an attacker mindset to exploit them. Through red-team style labs, they perform prompt injection attacks against agents, abuse overly permissive tools, extract secrets, and trigger unintended actions. The training then pivots to defense, covering secure agent design principles such as least privilege for tools, sandboxing and isolation, approval gates for high-risk actions, robust prompt controls, monitoring, and audit logging.
By the end of Day 2, participants understand how insecure agent design can turn AI systems into operational liabilities—and how to apply defense-in-depth strategies to prevent agents from going rogue in production environments.
The final day expands the scope to the broader AI tool ecosystem, with a deep dive into the Model Context Protocol (MCP). MCP is treated as a new AI supply chain, analogous to package managers such as npm or pip, with its own unique attack vectors and trust challenges.
Participants learn how MCP-based systems can be compromised through tool shadowing, impersonation, output poisoning, dependency vulnerabilities, and malicious updates. Hands-on labs demonstrate how attackers can bypass previously implemented LLM and agent defenses by exploiting insecure tool integrations. The course then focuses on building production-grade defenses, including zero-trust tool invocation, capability allowlisting, namespacing, mTLS-based authentication, output validation, and cryptographic verification of tools.
The day concludes with architectural design exercises, where participants design secure MCP gateways and observability pipelines, enabling detection, investigation, and response to AI-specific incidents in real-world environments.
By the end of the three days, participants will have built, attacked, and defended complete LLM + Agent + MCP systems. They will leave with a practical, end-to-end understanding of modern AI security, reference architectures for secure deployment, and a mindset shift from “how do we make AI work?” to “how can this system be abused—and how do we stop it?”
Hands-On Exploration Participants interact with a basic LLM to observe how prompt variations affect reasoning and outputs.
Understanding prompt pipelines, context assembly, and retrieval-augmented generation.
Hands-On Lab – Building a Secure Prompt Pipeline Participants build a simple LLM application that injects tool output into prompts and trace untrusted input through the pipeline. Estimated lab time: 30 minutes
Break : 11:00 – 11:15Attacking and defending against prompt-level control hijacking.
Hands-On Lab – Exploiting Prompt Injection Participants attack a vulnerable chatbot to extract system prompts, bypass safeguards, and trigger unsafe outputs. Lab time: 45 minutes
Defense Strategies
Hands-On Lab – Defending Against Prompt Injection Participants harden the chatbot and re-run attacks to validate defenses. Lab time: 30 minutes
Lunch Break : 12:45 – 1:45Protecting secrets in prompts, outputs, and retrieval pipelines.
Hands-On Lab – Extracting Secrets from LLM Responses Participants exploit an LLM system with access to sensitive data to force disclosure. Lab time: 45 minutes
Defense Strategies
Hands-On Lab – Implementing Output Filtering Participants deploy controls to prevent data leakage. Lab time: 30 minutes
Break : 3:15 – 3:30Live attack-and-defense walkthroughs.
Hands-On Lab – Extracting Secrets from LLM Responses Participants exploit an LLM system with access to sensitive data to force disclosure. Lab time: 45 minutes
Understanding agent loops and decision-making.
Hands-On Lab – Building a Simple AI Agent Participants build an agent that selects and invokes tools. Lab time: 30 minutes
Break : 10:45 – 11:00Hands-On Lab – Secure Agentic RAG Participants build and harden an agentic RAG workflow. Lab time: 45 minutes
Lunch Break : 12:30 – 1:30Adapting threat modeling for autonomous systems.
Hands-On Lab – AI Agent Threat Modeling Participants threat model an AI agent workflow using assisted techniques.Lab time: 45 minutes
Break : 3:00 – 3:15Hands-On Lab – Red Team an AI Agent Participants exploit a vulnerable agent to extract secrets and misuse tools.Lab time: 60 minutes
Hands-On Lab – Exploiting MCP Tools Participants exploit insecure MCP integrations. Lab time: 60 minutes
Hands-On Lab – Hardening MCP Systems Participants deploy defenses and re-test attacks. Lab time: 75 minutes
Hands-On Lab – Designing a Secure MCP Gateway Participants design a production-grade MCP gateway. Lab time: 60 minutes
This workshop is designed for security and engineering professionals who are building, deploying, or securing AI-driven systems in production environments, including:
This training is best suited for practitioners who want hands-on, offensive and defensive experience securing LLMs, AI agents, and AI tool ecosystems, rather than high-level or theoretical AI discussions.
