CTFs & labsFoundations
GitHub Secure Code Game
Practice finding and fixing software vulnerabilities; useful groundwork for securing agent applications.
FreeAvailable
Page inspected 2026-09-28Build agents.
Understand the risks.
Learn to secure, test, evaluate, and govern AI agents. Start with tool-using and coding-agent security: credentials, MCP, files, traces, and authorized scope. Broader foundations remain available.
Explore the library37 learning resourcesHuman-reviewed additionsDiscovery every other week
Where can a coding agent go wrong?
Our original threat model follows untrusted inputs through tool actions, review gates and execution boundaries. Built for students working with Apollo Watcher.
Recorded does not mean prevented. Learn which actions reach review—and which need independent controls.
Original learning aid · Reviewed 28 September 2026
The library
Follow the coding-agent / tool-using track
Use labs and testing tools only in environments where you have authorization.
Start with labs and tools, then deepen your understanding through guidance and research.
Showing 20 agent-specific resources
CTFs & labsAgent-specific
OWASP FinBot CTF
Practice goal manipulation and prompt injection against a deliberately vulnerable invoice-processing agent.
Free / infrastructure costsAvailable
Page inspected 2026-09-28CTFs & labsAgent-specific
PwnGPT — Agentic LLM CTF
Self-hosted prompt-injection challenges with tool use and multiple agent levels.
Free / infrastructure costsAvailable
Page inspected 2026-09-28Repositories & toolsAgent-specific
AgentDojo
Research environment for evaluating prompt-injection attacks and defenses in tool-using agents.
Free / infrastructure costsAvailable
Page inspected 2026-09-28Repositories & toolsAgent-specific
agentgateway
Open-source gateway with documented JWT, API-key and OAuth authentication, fine-grained authorization, rate limits, TLS, and telemetry for MCP, A2A and model traffic. Quickstarts provide a starting point for studying agent access controls and observability; features were documented, not deployment-tested.
Free / infrastructure costsAvailable
Page inspected 2026-10-07Repositories & toolsAgent-specific
Apollo Research Watcher
Runtime monitoring and control project for studying and managing agent behavior.
Check providerAvailable
Page inspected 2026-09-28Repositories & toolsBroader AI
Darkmoon
Open-source (GPLv3) autonomous penetration-testing platform, built and maintained by ASC-IT (the Darkmoon team). An LLM orchestrates specialist agents and offensive tools over a controlled, logged MCP interface, running on local models (Ollama, llama.cpp) or cloud providers (Anthropic, OpenAI, OpenRouter). Instructive for studying how an agentic system plans and chains tools end to end, and how an MCP gatekeeping layer and a local Privacy Gateway (reversible tokenization of real IPs, hosts and credentials) constrain it. Each finding is documented with the exact command run and its raw output; exploit confirmation is agent-asserted (re-tested only in the paid Pro tier), not a guaranteed real exploit. The free Community edition is a CLI/SDK; the web dashboard and remediation-to-pull-request are paid Darkmoon Pro. Advanced / disposable-lab setup only: the default docker-compose uses host networking, runs as root, and mounts the Docker socket and kubeconfig, so run it only against an authorized throwaway lab, never a daily-use machine or production.
Free / infrastructure costsAvailable
Page inspected 2026-10-06Repositories & toolsBroader AI
Microsoft PyRIT
Open-source framework for identifying generative AI risks through adversarial testing.
Free / infrastructure costsAvailable
Page inspected 2026-09-28Repositories & toolsBroader AI
NVIDIA garak
LLM vulnerability scanner useful for learning about model-level risks within agent systems.
Free / infrastructure costsAvailable
Page inspected 2026-09-28Repositories & toolsAgent-specific
Orca AI Incident Archive
Vendor-maintained (Continuum AI) archive of publicly disclosed AI agent security events, including incidents, vulnerabilities, research and policy. Distinguishes confirmed harm from demonstrations and labels disputed records and broader AI infrastructure. Source-linked case studies; verify individual cases against their cited sources.
FreeAvailable
Page inspected 2026-10-07Guides & standardsAgent-specific
Coding Agent Threat Model — Apollo Watcher Student Guide
Original infographic and student worksheet tracing coding-agent threats, Watcher review coverage and independent execution controls. Includes primary sources and a harmless classroom exercise.
FreeAvailable
Page inspected 2026-09-28Guides & standardsAgent-specific
CSA Autonomous Action Runtime Management
Working group exploring runtime controls and governance for autonomous actions.
FreeAvailable
Page inspected 2026-09-28Guides & standardsFoundations
Linux Foundation: Agentic AI Foundation
Background on the foundation and projects including MCP, goose, and AGENTS.md; an ecosystem orientation resource.
FreeAvailable
Page inspected 2026-09-28Guides & standardsAgent-specific
MCP Security Best Practices
Official guidance on authorization, confused-deputy risks, token handling, and other MCP security concerns.
FreeAvailable
Page inspected 2026-09-28Guides & standardsBroader AI
NIST AI Risk Management Framework
Voluntary framework for governing, mapping, measuring, and managing AI risk. Foundation for agent governance; not a certification.
FreeAvailable
Page inspected 2026-09-28Guides & standardsAgent-specific
OWASP Agentic Security Initiative
Threat models, community guidance, and security workstreams for autonomous agents.
FreeAvailable
Page inspected 2026-09-28Guides & standardsAgent-specific
Proof-of-Control v1.0 Working Draft
Advanced AI Society working draft on runtime evidence, authorization, and independent verification of agent actions, with schemas and reference artifacts. Distinguishes tamper-evident records from complete observation and gated execution. Public comment is open through October 30, 2026; draft claims are not established production guarantees.
FreeAvailable
Page inspected 2026-10-07ResearchAgent-specific
AGATE: Provenance-Based Runtime Defense
Research on a harness-level authorization and data-provenance gate with deterministic decisions, without an LLM in the decision path. Reports limits involving transformations, legitimate reuse and observation coverage.
FreeAvailable
Page inspected 2026-09-28ResearchAgent-specific
LLM Agents Can Easily Tamper With Their Own Traces
Research on agents altering local execution records. Examines trace custody and argues for independent interception outside the agent’s control; findings concern the tested configurations.
FreeAvailable
Page inspected 2026-09-28ResearchAgent-specific
ScopeBench: Do Agents Preserve Engagement Boundaries Under Goal Pressure?
Benchmark separating task capability from scope adherence under goal pressure. Study of 30 tasks and eight models in one harness; useful for reasoning about rules of engagement, not a universal safety score.
FreeAvailable
Page inspected 2026-09-28PodcastsBroader AI
80,000 Hours Podcast
Long-form interviews including AI risk, alignment, and governance; the feed also covers other topics.
FreeAvailable
Page inspected 2026-09-28CoursesAgent-specific
Agentic AI Development & Security
Specialization combining agent development and security concepts. Verify enrollment and certificate terms.
Check providerAvailable
Page inspected 2026-09-28CoursesBroader AI
AI Security Academy
AI security training catalog; select courses based on their syllabus and agent relevance.
Check providerAvailable
Page inspected 2026-09-28CoursesAgent-specific
AI Security University: MCP Security Fundamentals
Free, self-paced course with 21 lessons on MCP architecture, the OWASP MCP Top 10, incidents, and mitigations. Covers token exposure, privilege escalation, tool poisoning, supply-chain tampering, and command injection. The provider issues a verifiable course-completion certificate after a final quiz.
FreeAvailable
Page inspected 2026-10-07CoursesAgent-specific
Astrix AI Agent Training Program
Vendor-produced training collection about AI agents and their security.
Check providerAvailable
Page inspected 2026-09-28CertificationsAgent-specific
AWS Securing Agent Identities Demonstrated
AWS microcredential assessing agent workload identities, tag-based access control, scoped JWT authorization, authentication methods, and token audit trails in a timed, live AWS lab. AWS states no Skill Builder subscription is required; passing earns a Credly badge. Distinct from AWS Certification.
FreeAvailable
Page inspected 2026-10-07CertificationsAgent-specific
Certified Agentic AI Security Expert (CAASE)
Provider describes practical training in agent reasoning, memory, tool use, and multi-agent identity. Listed as coming soon when checked.
PaidComing soon
Page inspected 2026-09-28CertificationsBroader AI
CSA Trusted AI Safety Expert (TAISE)
AI safety certificate program covering organizational practices and responsible adoption.
PaidAvailable
Page inspected 2026-09-28Blogs & newslettersBroader AI
Embrace The Red
Security research blog with practical investigations of prompt injection, assistants, and agent attack surfaces.
FreeAvailable
Page inspected 2026-09-28BooksBroader AI
Introduction to AI Safety, Ethics, and Society
Online textbook introducing AI risks, safety, ethics, and societal governance.
FreeAvailable
Page inspected 2026-09-28CertificationsFoundations
LangChain Certified Agent Engineer
Agent engineering credential. Useful implementation background, not a dedicated agent-security certification.
Check providerAvailable
Page inspected 2026-09-28YouTube channelsFoundations
OWASP Foundation YouTube
Application-security conference recordings, including AI security content. Choose agent-specific talks within this broad channel.
FreeAvailable
Page inspected 2026-09-28CertificationsAgent-specific
Pwned Labs AI Systems Red Team Professional (AISRTP)
Provider-described practical certification covering prompt injection, RAG poisoning, agent/tool abuse, and MCP attack paths. The associated bootcamp lists a 24-hour hands-on exam and an October 20, 2026 launch; verify current enrollment and assessment terms.
PaidComing soon
Page inspected 2026-10-07CoursesAgent-specific
SANS SEC546: Securing Agentic AI
Instructor-led training focused on securing agentic AI systems. Check current dates and prerequisites with SANS.
PaidAvailable
Page inspected 2026-09-28CertificationsAgent-specific
SecOps Group Certified Agentic AI Pentester (C-AgAIPen)
Provider-described intermediate, four-hour practical exam with flag-based challenges against agentic applications accessed over VPN. Covers prompt injection, goal hijacking, tool abuse, memory, and multi-agent workflows. Prior application pentesting experience is recommended; the provider prohibits AI assistance during the exam.
PaidAvailable
Page inspected 2026-10-07Videos & webinarsAgent-specific
Securing Agentic AI: Where Do You Start?
SANS introductory webcast on approaching agentic AI security. Registration or replay availability may vary.
Check providerCheck provider
Page inspected 2026-09-28Blogs & newslettersAgent-specific
Simon Willison: Prompt Injection
Technical explanations and commentary on prompt injection and the risks of tool-using AI systems.
FreeAvailable
Page inspected 2026-09-28No matching resources
Try a broader search or clear your filters to see the full library.
Curated by people. Discovered with automation.
New resources arrive as pull requests for a maintainer to evaluate. Merging a proposal adds it here. Labels distinguish agent-specific learning from broader AI and foundational material. Inclusion is not an endorsement; verify availability and cost with each provider.
Read the curation policy