Stay Safe with AI: A Developer's Guide

Overview of the course, learning objectives and topics

Tokens, context windows, training, and inference -- the minimum a developer needs to reason about the security implications of every AI interaction. Understanding how models process input and generate output explains why every token in a prompt reaches the provider's servers and why AI output cannot be treated as verified.

In this lab you will see how a machine learning model can be tricked by very small changes to its input.

What AI coding tools transmit, where that data goes, and the trust decisions developers make implicitly each time they accept a suggestion or open a file. Opening a secrets file in an AI-enabled editor is functionally equivalent to pasting its full contents into the chat -- without any deliberate action from the developer.

How attackers embed instructions in repositories, documents, and issues that your AI tool reads, causing it to act on the attacker's behalf rather than yours. This is the foundational attack pattern behind MCP exploitation and agentic attacks, and it requires no access to your machine or your account -- only to content your tool will read.

Complete this lab to learn how prompt injection works in practice

The categories of data that commonly reach AI providers through prompts, IDE context, agent tool output, and MCP server responses -- and the techniques for preventing leakage before it leaves your environment. Most leakage is unintentional: the sensitive content is incidental to the question, but it still reaches the provider.

Open a repository in your AI-enabled editor and ask a natural question about the codebase. Injection payloads hidden across five different file types hijack your AI assistant and make it respond with a message the attacker chose instead of answering your question. You will find every injection point, explain why the AI followed each one, and apply remediations that stop the attack.

Hallucinated package names that attackers register on public registries, insecure defaults in AI output, and why accepting a suggestion that compiles is not the same as accepting one that is safe. This module focuses on slopsquatting and the verification habits that prevent supply chain compromise through AI tooling.

Four Python files generated by an AI coding assistant -- each containing a mix of real and hallucinated package imports that follow PyPI naming conventions closely enough to pass a quick scan. You will verify every package against the registry, assess the risk of each hallucinated name, examine how a malicious package executes code silently at install time, and write a pre-install check script that flags unverified packages before they reach your machine.

The attack surface introduced by Model Context Protocol servers: malicious registrations, rug-pull attacks, tool-call hijacking via prompt injection, and over-permissioned configurations. MCP is the mechanism by which AI tools take real-world actions, making server vetting critical before anything is installed or connected to an agent.

Complete these hands-on lab to learn how to secure against malicious MCP servers

How AI shifts social engineering from low-quality mass campaigns to high-fidelity attacks targeting developers specifically: hyper-personalised phishing, fake pull requests from cultivated personas, synthetic developer identities used to obtain employment, and deepfake voice and video calls. The defences are structural, not grammatical -- AI has eliminated the signals developers historically used to detect these attacks.