Phase 0: Security Fundamentals for AI · 55 min · Python · OWASP LLM Top 10

Attack Surface Mapping for LLM Applications & Agents

Every capability you add is a door. Map the doors before someone else does.

Hiring signal: Being able to decompose an unfamiliar LLM application into its attack surface layers in minutes is exactly what a red team engagement kickoff or a security design review looks like in practice — it's the first thing a hiring manager will ask you to do live with a system you've never seen.

What you will learn

Decompose any LLM application into its 6 attack surface layers: model, prompt, retrieval, tool, agent, infrastructure
Map each OWASP LLM Top 10 category onto the layer(s) where it actually lives
Explain how attack surface grows non-linearly as capabilities are added to an agent
Prioritize which layers to defend first using exploitability and blast radius

The Problem

A support bot that only answers questions from a fixed FAQ has almost no attack surface — worst case, it says something embarrassing. Give that same bot a vector database of internal documents, a refund_order tool, and a planning loop that decides which tools to call, and you now have four qualitatively different places an attacker can push on: the model, the retrieved content, the tool arguments, and the agent's own decision-making. None of those existed as attack surface a week earlier when the bot only did FAQ lookup.

This is the pattern behind almost every serious AI security incident: teams reason about new capabilities in terms of what they enable, not what they expose. The EchoLeak vulnerability (CVE-2025-32711) existed because email content — a retrieval-adjacent input — was never modeled as something that could redirect tool use. The Chevrolet dealership chatbot incident existed because a thin prompt layer had no defense against being talked into a "legally binding" statement. Different layers, same root cause: nobody enumerated the layers before shipping.

The fix is a decomposition exercise you can run on any LLM application in about ten minutes, even one you've never seen before: break it into six layers, and ask what attacks live at each one.

The 6-Layer Model

Layer	What lives here	Example attacks
Model	Weights, fine-tuning, inference endpoint	Model theft via extraction queries, denial-of-service via adversarial inputs
Prompt	System prompt, user/assistant message channel	Direct prompt injection, jailbreaks, system prompt extraction
Retrieval	RAG corpus, vector DB, embeddings	Corpus poisoning, indirect injection via retrieved documents, embedding inversion
Tool	Function-calling schemas, arguments, connected systems	Insecure plugin design, tool argument injection, unsanitized tool output
Agent	Planning loops, memory, multi-agent orchestration	Excessive agency, goal hijacking, multi-agent injection propagation
Infrastructure	Hosting, network egress, secrets, CI/CD, supply chain	Credential leakage, poisoned dependencies, exfiltration via unrestricted egress

Each layer sits directly on top of the ones before it — a Tool-layer attack is only possible because the Prompt layer let attacker-influenced text reach a tool call, which is only possible because the Model layer will act on that text at all. Attack surface doesn't just add up across layers; it compounds.

Unlock the full lesson

You've read the first 2 sections. The rest of this lesson covers Mapping OWASP LLM Top 10 Categories onto the Layers, Diagramming a Real System's Attack Surface, Prioritizing Layers by Exploitability × Blast Radius, Build It, What to Practice — plus a hands-on lab, quiz, and project artifact.

Create a free account to unlock Phase 0 and Phase 1 of every course — no credit card.