This repository is a sample security workbook for teams building agentic AI applications — systems that call tools, hold memory, orchestrate sub-agents, and take real-world actions. It focuses on how those agents fail in production, and how to design them so common attacks and misuse paths are harder to exploit.
The workbook is organised around OWASP risk categories for LLM and agentic systems — specifically the LLM Top 10 (2025) and the Top 10 for Agentic Applications (ASI) 2026. Each chapter targets one or more of those risks (for example prompt injection, tool misuse, supply chain, cascading failures, or rogue agents), with vulnerable and secure patterns you can apply while building.
14 chapters. Vulnerable vs secure patterns in every chapter. Sample exploits. Sample fixes.
Every chapter follows the same recipe: scenario → vulnerable code → what breaks → secure code → what changed → hands-on lab.
| What you want | Where to go |
|---|---|
| Read a chapter | chapters/ |
| Run the hands-on lab | labs/ — open the matching .ipynb locally |
| Copy a code snippet | snippets/ — vulnerable.py + secure.py per chapter |
| CI regression stub | tests/ |
Works with a public clone or an offline copy. No Colab required.
git clone https://github.com/OWASP/SecureAI-Guide.git
cd SecureAI-Guide
pip install -r requirements.txtThen open any notebook in Cursor, VS Code, or Jupyter:
# Option A — Cursor / VS Code: open labs/01-prompt-injection.ipynb and run cells
# Option B — classic Jupyter
jupyter notebook labs/Labs use a mock LLM — no API key needed.
Optional Jupyter install (if you prefer the classic UI):
pip install jupyter notebook ipykernelRun pattern regression tests:
python3 -m pytest tests/ -q| # | Chapter | OWASP | Lab (local) |
|---|---|---|---|
| 01 | Don't Trust the Prompt | LLM01, ASI01 | lab |
| 02 | Your Tools Are Attack Surface | ASI02, LLM06 | lab |
| 03 | Secrets Don't Belong in Prompts | LLM02, LLM07 | lab |
| 04 | Memory Is Not Magic | ASI06, LLM08 | lab |
| 05 | One Agent, One Job | ASI03, LLM06 | lab |
| 06 | Multi-Agent Trust Is Not Free | ASI07, ASI03 | lab |
| 07 | Don't Render What the Model Returns | LLM05, ASI02 | lab |
| 08 | Give It a Leash | LLM10, LLM06, ASI09 | lab |
| 09 | Vet Your Plugins | ASI04, LLM03 | lab |
| 10 | Show Your Work | Observability (cross-cutting) | lab |
| 11 | Sandbox the Code | ASI05 | lab |
| 12 | Stop the Cascade | ASI08 | lab |
| 13 | Don't Rubber-Stamp | ASI09 | lab |
| 14 | Catch the Rogue | ASI10 | lab |
SecureAI-Guide/
├── README.md
├── LICENSE
├── CONTRIBUTING.md
├── requirements.txt
├── chapters/ # 01–14 markdown chapters
├── labs/ # matching Jupyter notebooks (run locally)
├── snippets/ # 01–14 vulnerable.py + secure.py
└── tests/ # CI regression stubs for secure patterns
Contributions are welcome. See CONTRIBUTING.md for how to propose changes, the chapter recipe to follow, and the PR checklist.
In short: keep examples accurate, keep labs runnable without an API key, and open focused pull requests.
This project is licensed under the MIT License.
You are free to use, copy, modify, and distribute the material for open-source and commercial purposes, provided the copyright notice and license text are included.