Secure systems where many agents plan, delegate and act together, with identity, trust and containment across the mesh, in two days.
Two-day instructor-led advanced course. Module order and grouping can be adjusted for private deliveries.
The three main orchestrator patterns for multi-agent systems: hub-and-spoke, mesh and hierarchical. You study the tradeoffs of each pattern, understand where the trust boundaries sit in each one and identify which pattern creates the smallest attack surface for your use case.
How agents communicate over the A2A protocol. You study the message format, the authentication handshake and the session lifecycle, and you identify the points in the protocol where an attacker can intercept, modify or replay messages between agents.
How agents share memory and state, and the security risks that come with it. You examine shared memory stores, context passing and state synchronisation, and you identify how a compromised agent can poison shared state to influence the behaviour of other agents in the system.
How the attack surface grows with every agent you add to the system. You calculate the trust relationships, communication channels and delegation paths in a multi-agent system, and you see how quickly the number of attack paths exceeds what a human reviewer can reason about without structured analysis.
How agents verify each other's identity before trusting any message or delegation. You implement mutual identity verification using SPIFFE and AgentPass so each agent proves who it is on every interaction, not just on the first connection.
How trust propagates when one agent delegates work to another and that agent delegates further. You trace trust through delegation chains of three or more agents and identify where trust assumptions break down, where authority accumulates beyond what was intended and where a delegation should be rejected.
How authority narrows at each hop in a delegation chain. You implement scope attenuation so that every time an agent delegates to another agent, the delegated authority is equal to or less than what the delegating agent holds. You test that authority can never widen through delegation.
Stopping confused deputy attacks and authority laundering between agents. You study how a low-privilege agent can trick a high-privilege agent into acting on its behalf, and how agents can launder authority through delegation chains to gain permissions they were never granted directly. You build the controls that prevent both.
Hardening the orchestrator agent that coordinates the other agents. You study how a compromised orchestrator can turn the entire system against itself, and you implement controls that limit the orchestrator's authority, validate its decisions and prevent it from being hijacked through prompt injection.
Stopping prompt injection that arrives through the responses of other agents rather than from external input. You trace how a compromised agent can inject instructions into its response that the receiving agent follows, and you build the filters that treat inter-agent messages as untrusted content.
Defining and enforcing which agents can call which other agents. You build a call permission matrix that restricts agent-to-agent communication to only the paths that are needed, and you block any call that is not explicitly allowed so a compromised agent cannot reach agents it was never meant to contact.
Setting rate limits and resource budgets per agent to prevent runaway loops and cost blowouts. You configure per-agent limits on API calls, token consumption, execution time and downstream requests, and you test that the limits hold when an agent enters a feedback loop or attempts to exhaust shared resources.
Keeping agents isolated so a compromise of one does not automatically give the attacker access to the others. You implement process-level, network-level and credential-level isolation between agents and test that a compromised agent cannot read another agent's memory, credentials or communication channels.
Building kill switches that can stop an individual agent or an entire swarm immediately. You implement agent-level and swarm-level kill switches, wire them to human authority gates, and test that activation is immediate and that a killed agent cannot restart itself or delegate its work to a peer before stopping.
Revoking credentials across a multi-agent system when one agent is compromised. You implement credential revocation that propagates to every agent that received delegated credentials from the compromised agent, and you verify that revocation takes effect before the compromised credentials can be used again.
Assessing the blast radius when one agent in a multi-agent system is compromised. You map every agent, tool, data store and external system the compromised agent can reach directly or through delegation, and you produce a blast radius report that shows the maximum damage a single compromised agent can cause.
Building observability into a multi-agent system so you can see what every agent is doing in near real time. You set up logging, tracing and metrics collection across agents, correlate events across the swarm and build dashboards that show the health and behaviour of the entire system at a glance.
Correlating events across multiple agents to detect attack patterns that no single agent's logs would reveal. You build correlation rules that link actions across agents by time, session, delegation chain and shared context, and you test them against scenarios where a multi-step attack spans several agents.
Detecting when multiple agents are behaving anomalously in a coordinated way that suggests a systemic compromise rather than an isolated incident. You build detection rules for coordinated anomalies including simultaneous privilege escalation, parallel data exfiltration and synchronised evasion across agents.
A structured lab where you attack a running multi-agent system. You compromise one agent through prompt injection, escalate through delegation chains, launder authority across agents, poison shared state and attempt to spread the compromise across the swarm. Every attack is recorded and scored.
A hands-on lab where you harden the orchestrator and the agent-to-agent communication layer. You implement mutual identity verification, scope attenuation, call permission matrices and rate limits, then re-run the attacks from the previous lab to verify the controls hold.
A lab focused on containment and recovery. You trigger a kill switch, revoke credentials across the swarm, assess the blast radius of a compromised agent and verify that isolation, revocation and monitoring all work together to stop the compromise from spreading.
Hands-on with the CyberSecAI tooling, not slideware.
A multi-agent attack sandbox where you inject one agent and watch the compromise spread.
Per-agent identity and scoped authority.
Graduated L0 to L4 approval gate between agents.
The vulnerable substrate the agents run on.
Build and run orchestrated agents with identity and scoped delegation between them.
Design agent meshes you can secure, contain and prove.
Ship orchestrated or agent-to-agent systems that pass security review.
Govern autonomous agent-to-agent action with signed, non-repudiable evidence.
This course counts toward the CyberSecAI AISVS assurance track, mapping multi-agent controls to the standard co-led by your instructor.
Two days, hands-on, securing multi-agent systems end to end, taught by the former OWASP-AISVS Co-Leader (v1.0) and the author of the MCPS, ATTP and agent-payment-trust Internet-Drafts. Places are limited.
Corporate & sovereign cohorts, and bespoke on-site delivery, on request.