CYBRARY Program catalog
AI security labs
Agents now read your alerts, call your tools and close your cases. Learn to treat every part of that pipeline as untrusted input, and to keep autonomy behind a boundary you can defend.
30 labs across 7 stages. Prerequisites are advice, not a lock — you can open any lab, but the ones listed underneath it are what it assumes.
Your study plan
Loading your record…
Proves: AI and agent security · Control assurance
Generative-attack shift — 0/5 phases proven (0% of the labs behind them)
- • 1 · The queue turns hostile0/3ag-alert-injection
- • 2 · A helpful new tool appears0/4ag-tool-poisoning
- • 3 · One token, every door0/5ag-token-audience
- • 4 · The approval that would cost the estate0/4ag-blast-radius
- • 5 · The morning after0/3ag-lineage-gap
Enterprise stage locked: prove the remaining 5 phases (or pass the capstone) to open it.
Generative-attack capstone — 4 prerequisites left
A full oversight shift at Northwind Logistics while an adversary generates hostile alerts, tool manifests and follow-up prompts, graded phase by phase from the run.
- ag-shift-capstone — Both chairs is the full shift again, with a partner and no reset.
- ag-blast-radius — The generative-attack shift turns on refusing one framed-as-routine containment, so the ceiling has to be a habit first.
- ag-lineage-gap — The debrief phase is graded on lineage for every claim the agent made.
- ag-token-audience — The identity phase assumes you already audience-scope a tool token by reflex.
1 · Basics: how an agent gets used against you
Two lightweight failures first — a tool that is too helpful, and two servers claiming one name — plus the habit of shipping a tool that cannot be turned around.
- ag-tool-poisoningThe helpful new tool35 min
AI and agent security · Control assurance
T1195.002 Compromise Software Supply ChainT1554 Compromise Host Software Binary
- ag-namespace-squatTwo servers, one name35 min
AI and agent security · Control assurance
T1036.005 Masquerading: Match Legitimate NameT1195.002 Compromise Software Supply Chain
Assumes first:
- ag-tool-poisoning — Name collisions only matter once you can read what a tool description really asks.
- mcp-f1-safe-toolShip a tool nobody can turn against you30 min
AI and agent security · Detection engineering
T1195.002 Compromise Software Supply ChainT1554 Compromise Host Software BinaryT1036.005 Masquerading: Match Legitimate Name
Assumes first:
- ag-tool-poisoning — You write a safe tool by having seen the unsafe one abused first.
2 · Text as untrusted input
The first lesson and the one people keep failing: content the agent reads is not instruction — in the alert body, and in the memory that outlives the shift.
- a-210Prompt injection in an alert body40 min
AI and agent security · Response automation
Assumes first:
- ag-tool-poisoning — Prompt injection is the same untrusted-text lesson, arriving through the alert body.
- f-101 — Injection in a playbook context assumes you know how a workflow run is structured.
- ag-alert-injectionThe alert that gives orders40 min
AI and agent security · Incident triage
T1566 PhishingT1204.002 User Execution: Malicious FileT1059 Command and Scripting Interpreter
Assumes first:
- a-210 — The live runner replays the injected alert against a policy you have to edit.
- ag-memory-contaminationThe note that outlives the shift40 min
AI and agent security · Incident triage
T1505 Server Software ComponentT1565.001 Stored Data Manipulation
Assumes first:
- ag-alert-injection — Poisoned memory is injection that survives the shift, so start with the single turn.
3 · The tool catalog is a supply chain
Tool descriptions, manifests, registry entries and vendor builds — the supply chain nobody audits.
- a-220A poisoned tool in the agent's own catalog45 min
AI and agent security · Incident triage
Assumes first:
- mcp-f1-safe-tool — Auditing a poisoned catalog assumes you know what a well-formed tool looks like.
- c-201 — Auditing an agent's tool catalog is the same case read three ways, one vocabulary per tool.
- mcp-f2-harden-poisonedRewrite the poisoned manifest35 min
AI and agent security · Control assurance
T1195.002 Compromise Software Supply ChainT1554 Compromise Host Software Binary
Assumes first:
- a-220 — Rewriting the manifest is the remediation for the poisoning you have already found.
- ag-registry-integritySame entry, different build35 min
AI and agent security · Control assurance
T1195.002 Compromise Software Supply ChainT1036.005 Masquerading: Match Legitimate Name
Assumes first:
- mcp-f2-harden-poisoned — Registry drift is manifest trust moved from one server to the publishing pipeline.
- ag-binary-driftThe vendor hotfix35 min
AI and agent security · Vulnerability and patch assurance
T1554 Compromise Host Software BinaryT1195.002 Compromise Software Supply Chain
Assumes first:
- ag-registry-integrity — A vendor hotfix is the same integrity question about the build behind the entry.
4 · Identity, tenancy and the network boundary
Who the agent is when it calls a tool, which tenant's data it can reach, and what its egress path really resolves to.
- ag-token-audienceOne token, every door40 min
AI and agent security · Control assurance
T1528 Steal Application Access TokenT1550.001 Use Alternate Auth Material: App Access Token
Assumes first:
- a-220 — Tool identity comes before token audience: you need to know who is calling what.
- ag-confused-deputyOne credential, three agents35 min
AI and agent security · Incident triage
T1550.001 Use Alternate Auth Material: App Access TokenT1078 Valid Accounts
Assumes first:
- ag-token-audience — One credential across three agents is the audience failure with a human in the way.
- ag-cross-tenant-stateThe case one number down35 min
AI and agent security · Evidence handling
T1530 Data from Cloud StorageT1078.004 Valid Accounts: Cloud Accounts
Assumes first:
- ag-token-audience — Tenant isolation is enforced by the same claims you learned to check on the token.
- ag-discovery-ssrfThe well-known redirect40 min
AI and agent security · Threat hunting
T1190 Exploit Public-Facing ApplicationT1552.005 Cloud Instance Metadata API
Assumes first:
- ag-confused-deputy — Server discovery abuse assumes you can already trace which identity made the call.
- ag-dns-rebindingThe header says it is us40 min
AI and agent security · Threat hunting
T1090 ProxyT1071.004 Application Layer Protocol: DNS
Assumes first:
- ag-discovery-ssrf — Rebinding is the same egress boundary, re-resolved after the check passed.
- ag-sandbox-escapeIt only needs a shell35 min
AI and agent security · Incident triage
T1611 Escape to HostT1059.004 Unix Shell
Assumes first:
- ag-discovery-ssrf — Escaping the sandbox starts from the reachability you established in discovery.
5 · Oversight, blast radius and provenance
Approval ceilings, spend limits, elicitation prompts and the lineage that lets you say which tool produced a claim.
- ag-blast-radiusContain the site35 min
AI and agent security · Response automation
T1489 Service StopT1531 Account Access Removal
Assumes first:
- ag-memory-contamination — Containment scope is the answer to an agent that has already been steered wrong.
- ag-cost-exhaustionFourteen lookups a minute30 min
AI and agent security · Control assurance
T1496 Resource Hijacking
Assumes first:
- ag-blast-radius — Spend ceilings are blast radius expressed in budget instead of hosts.
- ag-elicitation-abuseSession expired30 min
AI and agent security · Incident triage
T1621 Multi-Factor Authentication Request Generation
Assumes first:
- ag-blast-radius — A fake re-auth prompt only works when approval flow is something you can reason about.
- ag-data-exfiltrationThe brief that took the credentials with it35 min
AI and agent security · Evidence handling
T1041 Exfiltration Over C2 ChannelT1567 Exfiltration Over Web Service
Assumes first:
- ag-cross-tenant-state — Exfiltration through a brief is tenancy leakage with the agent as the courier.
- ag-lineage-gapWhich tool said that?35 min
AI and agent security · Evidence handling
T1070 Indicator RemovalT1562.008 Impair Defenses: Disable Cloud Logs
Assumes first:
- ag-data-exfiltration — Provenance is what lets you say afterwards which tool moved the data.
- ag-shadow-discoveryNobody filed a ticket for it35 min
AI and agent security · Threat hunting
T1526 Cloud Service DiscoveryT1046 Network Service Discovery
Assumes first:
- ag-lineage-gap — Unregistered servers are found by the lineage you learned to demand.
- ag-x1-samplingThe server that borrowed your model40 min
AI and agent security · Control assurance
T1496 Resource HijackingT1550.001 Use Alternate Auth Material: App Access Token
Assumes first:
- ag-lineage-gap — Borrowed sampling is a provenance question about the model, not the tool.
6 · Autonomous shifts, graded
A whole shift with the agent working beside you, the adversarial suite it has to survive, and the debrief the morning after.
- a-230AI security capstone: autonomous triage under oversight75 min
AI and agent security · Response automation · Evidence handling
Assumes first:
- ag-memory-contamination — The oversight capstone assumes injection and memory poisoning are already understood.
- ag-binary-drift — Supply-chain trust is one of the ceilings the capstone asks you to defend.
- mcp-f3-adversarial-runnerSurvive the whole suite45 min
AI and agent security · Detection engineering
T1566 PhishingT1195.002 Compromise Software Supply ChainT1550.001 Use Alternate Auth Material: App Access TokenT1041 Exfiltration Over C2 ChannelT1489 Service StopT1611 Escape to Host
Assumes first:
- a-230 — The adversarial suite grades the hardened posture the capstone made you argue for.
- ag-shift-capstoneOne whole shift60 min
AI and agent security · Incident triage · Response automation
T1566 PhishingT1195.002 Compromise Software Supply ChainT1550.001 Use Alternate Auth Material: App Access TokenT1041 Exfiltration Over C2 ChannelT1489 Service StopT1611 Escape to Host
Assumes first:
- mcp-f3-adversarial-runner — Survive the suite before you run a whole shift against it live.
- ag-l20-full-shiftThe whole shift, both chairs75 min
AI and agent security · Incident triage · Response automation · Evidence handling
T1566 PhishingT1195.002 Compromise Software Supply ChainT1550.001 Use Alternate Auth Material: App Access TokenT1041 Exfiltration Over C2 ChannelT1489 Service StopT1611 Escape to HostT1505 Server Software ComponentT1530 Data from Cloud Storage
Assumes first:
- ag-shift-capstone — Both chairs is the full shift again, with a partner and no reset.
- ag-blast-radius — The generative-attack shift turns on refusing one framed-as-routine containment, so the ceiling has to be a habit first.
- ag-lineage-gap — The debrief phase is graded on lineage for every claim the agent made.
- ag-token-audience — The identity phase assumes you already audience-scope a tool token by reflex.
7 · Enterprise scale
One held shift is not a governed agent estate. This stage moves the work off the incident and onto the organization: the monitoring that keeps proving agent autonomy between shifts, the review that turns a bad night into a changed control, and an independent assurance pass over what was promised.
- cmp-201Continuous control monitoring, honestly45 min
Audit and control evidence · Risk and policy governance
Assumes first:
- ran-410 — Continuous monitoring is the after-action control uplift, kept honest between incidents.
- ag-l20-full-shift — Agent autonomy is a control that has to keep proving itself between shifts, not once at the capstone.
- ir-301The review that changes something60 min
Incident triage · Evidence handling · Risk and policy governance
Assumes first:
- ag-l20-full-shift — The morning-after review only changes something when you have held the shift it reviews.
- dr-405Northwind assurance pass90 min
Control assurance · Detection engineering
Assumes first:
- ran-410 — Recovery assurance re-tests the control uplift the after-action review committed to.
- ran-420 — Recovery assurance re-tests the full kill-chain outcome, so run the capstone before it is assessed.
- ir-301 — Assurance re-tests the uplift the incident review committed to, so run the review first.