Certified AI Security Champion: A Hands-On Introduction to AI Security - Abhay Bhargav (AppSecEngineer)- DCTSG2027
Description
Name of Training: Certified AI Security Champion
Trainer(s): Abhay Bhargav (AppSecEngineer)
Skill Level: Beginner
Dates: March 5, 2027
Time: 9 to 5 pm
Venue: TBD
Early Bird Cost: S$2,700 (incl. GST, until Dec 31, 2026)
Regular Cost: S$3000 (incl. GST)
Short Summary
Certified AI Security Champion is a one-day, hands-on introduction to attacking and defending LLM-enabled apps, RAG, memory, agents and tools, MCP, and Agent Skills. Students run real attacks, build defenses, and receive access to a separate practical CTF certification exam after training.
Course Description
Certified AI Security Champion is a one-day introductory attack-and-defense course built around six places LLMs appear in modern applications: LLM-enabled apps, RAG, memory, agents and tools, MCP, and Agent Skills. Students understand each architecture, attack it in guided labs, and build defenses for prompt injection, leakage, vector and memory poisoning, excessive agency, unsafe tool invocation, MCP misconfiguration, and malicious skills. Defenses include safe output handling, retrieval provenance and filtering, memory scoping, least-privilege tools, human approval gates, scoped MCP permissions, skill review and sandboxing, Promptfoo red-teaming, and Vigil as an LLM firewall.
The course uses live models and pre-built browser-based AppSecEngineer environments with a 70:30 labs-to-theory ratio. No prior AI security experience or local setup is required. After training, students receive access to a separate 24-hour online CTF certification exam, which can be started anytime within one year; a score of at least 70% earns the Certified AI Security Champion certificate and digital badge.
Course Outline
View full outline
Hide outline
Day 1 - Morning
Module 0: How LLMs Enter Your Architecture
- Theory: What an LLM is and is not. Prompts, context windows, and tokens. The six contexts (LLM-enabled apps, RAG, memory, agents and tools, MCP, Agent Skills) and the trust boundaries each one creates. How to read an AI architecture diagram like an attacker.
Module 1: LLM-Enabled Applications
- Theory: Anatomy of an LLM-backed feature. Direct prompt injection, system prompt leakage, sensitive information disclosure, and insecure output handling. Where the OWASP Top 10 for LLMs fits.
- Attack labs:
- Prompt Injection: Bypass instructions and safety filters in a customer-facing assistant.
- System Prompt Leakage: Extract confidential instructions and embedded secrets.
- XSS via LLM Output: Turn model output into a client-side exploit in the host application.
- Defense labs:
- Output Handling and Encoding: Treat model output as untrusted and render it safely.
- Secrets Out of Prompts: Restructure the app so the prompt has nothing worth leaking.
Module 2: RAG and Memory
- Theory: How retrieval works: embeddings, vector stores, chunking, and ranking. Indirect prompt injection through documents. Types of memory (conversational, long-term, shared) and why memory turns a one-time injection into a persistent compromise.
- Attack labs:
- Vector Store Poisoning: Insert malicious content so the model retrieves attacker-controlled context.
- Indirect Injection via Documents: Plant hidden instructions in a file the assistant will summarise.
- Memory Poisoning: Persist a false fact into an assistant's long-term memory and watch it alter later decisions.
- Defense labs:
- Retrieval Trust Controls: Apply source provenance, access-scoped retrieval, and chunk-level filtering.
- Memory Scoping and Validation: Restrict what can be written to memory, validate it, and expire it.
Day 1 - Afternoon
Module 3:Agents and Tools
- Theory: The agent loop (sense, plan, act). Tool calling and function schemas. Excessive agency, unsafe tool invocation, confused-deputy problems, and autonomous decision loops.
- Attack labs:
- Excessive Agency: Trick a travel-booking agent into reading files and calling tools it was never meant to use.
- Tool Argument Injection: Manipulate the parameters an agent passes to a downstream tool.
- Chained Injection: Combine an indirect injection from Module 2 with a tool call to exfiltrate data.
- Defense labs:
- Tool Allow-Lists and Least Privilege: Constrain which tools an agent can call and with what scope.
- Semantic Guardrails and Human-in-the-Loop: Add semantic validation and approval gates for high-impact actions.
Module 4: MCP and Agent Skills
- Theory: What MCP is: servers, tools, resources, and prompts. OAuth and scoping in MCP. Tool description poisoning and rug-pull servers. What Agent Skills are, how they package instructions and scripts, and why they are a supply chain problem.
- Attack labs:
- MCP Gateway Bypass: Exploit a misconfigured gateway and over-broad OAuth scopes to reach restricted tools.
- Tool Description Poisoning: Hijack an agent through hidden instructions in an MCP server's tool metadata.
- Malicious Agent Skill: Install a skill that looks helpful but exfiltrates data and escalates its own permissions.
- Defense labs:
- Hardening MCP: Scope permissions, verify servers, and enforce policy at the gateway.
- Skill Review and Sandboxing: Review, pin, and sandbox skills; run a Promptfoo red-team suite and deploy Vigil as an LLM firewall in front of the agent.
Difficulty Level
Beginner - The student has an interest in the topic presented and general technology knowledge that a power user or undergraduate student may have acquired.;
Suggested Prerequisites
This is an introductory course. You need a basic understanding of how web applications work (requests, responses, APIs) and a general awareness of common security issues such as injection and access control. Comfort reading short Python snippets is helpful but not required; labs are guided and no code has to be written from scratch. No prior AI, machine learning, or LLM security experience is required. All core concepts, from tokens and prompts to agents and MCP, are introduced from scratch.
What Students Should Bring
Bring a laptop with a modern web browser. No local setup or special hardware is needed.
What the Trainer Will Provide
Cloud-based AppSecEngineer lab environment with all required tools, live LLM API access, and pre-built agent, RAG, and MCP environments. Certification exam access is issued after completion of the course.
Trainer(s) Bio
Abhay Bhargav is the Founder and Chief Research Officer of AppSecEngineer and co-founder of we45, where he focuses on building practical application security programs for modern, cloud-native environments. His work spans penetration testing, red teaming, DevSecOps, application security automation, threat modeling, and cloud-native security engineering. He designed Orchestron, created ThreatPlaybook, and created Juardrails, an open-source service for managing Jev-backed decision policies and guardrails.
Abhay is a long-time DEF CON trainer and speaker who has delivered hands-on training and talks at DEF CON, Black Hat, and OWASP AppSec events worldwide. His courses have consistently sold out across the US, Europe, and Asia. He is the author of two internationally published books on Java Security and PCI Compliance.
Proficiency Exam
Proficiency is evaluated through an online certification exam and a capstone project that students must record and share. After training, all students receive access to a 24-hour online CTF exam with 10-12 hands-on attack and defense challenges, which they may start anytime within one year. A score of at least 70% is required to pass, along with completion and submission of the recorded capstone project. Successful candidates earn the Certified AI Security Champion certificate and digital credential badge.
Registration Terms and Conditions
Trainings are refundable before January 29, 2027, minus a non-refundable processing fee of $350.
Between January 30, 2027 and February 28, 2027 partial refunds will be granted, equal to 50% of the course fee minus a processing fee of $350.
All trainings are non-refundable after Feb 28, 2027.
Training tickets may be transferred to another student. Please email us at training@defcon.org for specifics.
If a training does not reach the minimum registration requirement, it may be cancelled. In the event the training you choose is cancelled, you will be provided the option of receiving a full refund or transferring to another training (subject to availability).
Failure to attend the training without prior written notification will be considered a no-show. No refund will be given.
DEF CON Training may share student contact information, including names and emails, with the course instructor(s) to facilitate sharing of pre-work and course instructions. Instructors are required to safeguard this information and provide appropriate protection so that it is kept private. Instructors may not use student information outside the delivery of this course without the permission of the student.
By purchasing this ticket you agree to abide by the DEF CON Training Code of Conduct and the registration terms and conditions listed above.
Several breaks will be included throughout the day. Please note that food is not included.
All courses come with a certificate, contingent on attendance at 75% of course sessions. Students who pass the end-of-course evaluation will be issued a certificate of proficiency. All other students with sufficient course attendance will be issued a certificate of completion. Students are responsible for making sure their attendance is recorded at the start of the day and after returning from lunch.
