ai · security · skills

For the AI Security Engineer

Who contains a rogue agent when the board asks?

Track 2 · Your skills path is one click away. The story below is depth; the path names what to learn.

Score your mastery

The pipeline engineer ships the model. You secure what it can do once it runs.

Prompt injection, agent tool-scope, poisoned training data, a silent model swap — none of that is a lint rule.

When the board asks who contains a rogue agent, this is the role that answers.

26 controls

across 5 skill groups — secure the model, attack it before they do, contain the agent, guard the runtime, defend the training data — are the ones this role owns on the CSA spine.

the Track 2 reskilling master list — authored persona attribution over the AI Controls Matrix (AICM) v1.1.0

You are not replacing the SOC or the AppSec pipeline. You are the net-new discipline those roles cannot fold into.

The path is a mastery climb on the controls you own: direction, not a complete how-to, proved on a live app when the guard is fitted.

What do I reskill into — and how do I prove it before production trusts me?

Own the model-security controls. Attack them first. Contain the agent. Prove the fitted guard.

Three beats: the skill groups you own, the fence with DevSecAIOps, and the prove.

Your curriculum

Five skill groups on the controls you own.

Secure the model, attack it before they do, contain the agent, guard the runtime, defend the training data — each group rolls up the AI Controls Matrix (AICM) controls attributed to this role.

13 of those controls also gate the org’s autonomy climb (Model Security). Closing them is how you keep adoption from outrunning governance.

The application / DevSec track those controls land on →

The fence

Pipeline is theirs. Model and agent are yours.

DevSecAIOps owns the gates that catch AI failure modes in CI. You own adversarial ML, prompt differentiation, agent boundaries, model integrity, and training-data defense.

Compliance maps the regimes; you do not absorb their register work. Practitioner hunts and responds; you harden what they hunt against.

See the pipeline gates (the other side of the fence) →

The prove

Fit a guard. Measure it. Then trust it.

A shipped children’s-app guard caught just over half of its own attack classes; fitted to them, all of them — held-out included. That is the prove beat for this discipline.

Modeled on a fixed corpus, every number labeled — direction you can reproduce, not a black-box cert.

The worked prove — fitted, modeled, held-out →

Your reskilling list

26 controls have your name on them.

The groups from the story above, now control by control, with the gate marked.

1 to build · 8 to coordinate with a provider · 17 to verify, not build. Nobody reskills for what the provider already owns.

Secure the model

8 controls · 8 gate the climb

Attack it before they do

5 controls · 3 gate the climb

Contain the agent

5 controls

Guard the runtime

4 controls · 2 gate the climb

Defend the training data

4 controls

This is the same spine the assessment reads. Score your mastery on four concrete rungs per prompt, or run the function diagnostic — every gap lands on this list: the named skill, the group it belongs to, and who learns it.

Score mastery for this seat →Run the diagnostic. Your gaps land on this list →

Fresh for you · the practice keeps learning

New way to build itMDS-07 · 2026-07-20

OWASP Top 10 for Agentic Applications 2026 Defines the First Peer-Reviewed Framework for Autonomous AI Red Teaming

Released December 2025 and developed with input from over 100 security experts, the OWASP Top 10 for Agentic Applications 2026 is the first peer-reviewed framework for autonomous AI security, endorsed by NIST, Microsoft, NVIDIA, and the Alan Turing Institute. It covers ASI01 Agent Goal Hijack through ASI10 Rogue Agents. Documented real-world incidents include EchoLeak (CVE-2025-32711) zero-click prompt injection in Microsoft 365 Copilot, GitHub Copilot YOLO Mode (CVE-2025-53773) wormable RCE, CurXecute MCP auto-start RCE, Agent Session Smuggling in A2A, and Amazon Q Developer tool misuse. Mitigations include treating agents as first-class identities, sandboxing code execution, and implementing circuit breakers in multi-agent workflows.

Sharpens: Integrate the OWASP ASI 2026 framework into your AI red teaming program. Test agentic systems against all ten risk categories, with particular focus on ASI01 Goal Hijack (prompt injection via any text the agent reads), ASI02 Tool Misuse (legitimate tools used in unintended ways), and ASI04 Supply Chain Vulnerabilities (poisoned MCP servers and agent skills). Implement agent identity as distinct from user identity, authenticate inter-agent communication, and deploy circuit breakers that halt cascading failures in multi-agent workflows. · source

New way to build itLOG-15 · 2026-07-20

OpenTelemetry GenAI SIG Defines Standardized Semantic Conventions for AI Agent Observability and Security Telemetry

The OpenTelemetry GenAI Special Interest Group is establishing standardized semantic conventions for AI agent observability, covering agent application conventions (finalized) and agent framework conventions for CrewAI, AutoGen, LangGraph, and others. Key deliverables include standardized traces, metrics, and logs for agent step-level execution, tool calls, model interactions, and vector DB queries. Two instrumentation approaches are defined: baked-in native telemetry and external OpenTelemetry libraries. These conventions enable agent lifecycle correlation, context provenance tracking, and trust-boundary detection in multi-agent and agent-tool interactions. Adoption is projected to reach 98 percent within two years.

Sharpens: Adopt OpenTelemetry GenAI semantic conventions for agent observability instrumentation. Configure your agent framework to emit standardized spans for each agent step, tool invocation, and model interaction. Use these spans to construct context provenance chains that track which agent acted on whose authority with what retrieved context. Correlate agent lifecycle events with existing security telemetry to detect trust-boundary violations such as unauthorized tool invocations or cross-agent context leakage. · source

On the frontiernot yet on the CSA spine · 2026-07-20

Activation-Based Multi-Agent Collusion Detection Achieves 0.99 AUROC Against Steganographic Blackjack Card Counting

Oxford researchers introduce NARCBENCH, a benchmark for detecting covert multi-agent collusion from model internal activations. Five probing techniques aggregate per-agent deception scores to classify scenarios at the group level across Qwen3-32B, Llama-3.1-70B, DeepSeek-R1 32B, and GPT-OSS-20B. All models reach 1.00 AUROC in-distribution; Llama-3.1-70B achieves 0.99-1.00 AUROC on steganographic blackjack card counting where an LLM judge fails to discriminate. Detection performance scales with model capability. Collusion is framed as a distributed anomaly detection problem visible only when signals are combined across agents.

Sharpens: Deploy multi-agent interpretability as a complementary signal to text-level monitoring for agentic systems. Learn a deception direction from a training corpus of multi-agent scenarios, then project each agent's activations onto this direction to produce per-agent deception scores. Aggregate scores across agents using techniques like Peak Suspicion or Deception Split to detect collective anomalies invisible from any single agent alone. This white-box approach is particularly critical for steganographic collusion designed to evade text-level oversight. · source

What just shiftedIAM-18 · 2026-07-20

MCP Tool Poisoning Attack Pattern Turns Agent Tool Descriptions into Data Exfiltration Vectors

Microsoft Incident Response documents MCP tool poisoning, a supply chain attack where threat actors silently modify MCP tool descriptions (natural-language metadata agents read to decide tool calls), embedding hidden instructions that redirect agents to exfiltrate sensitive data. Each individual action appears legitimate; the vulnerability is in the trust boundary between agent and tool. Techniques first disclosed by Invariant Labs in April 2025 and observed in 2026 against enterprise agents. Microsoft maps detection controls across supply chain governance, tool metadata inspection, action guarding via DLP and human-in-the-loop, and cross-chain correlation in Sentinel.

Sharpens: Treat every MCP server as a supply chain dependency requiring security review. Treat tool descriptions as system prompts: require change review for tool description updates on critical agents and use prompt shields to inspect metadata for imperative language. Apply least agency by disabling 'allow all' tool access and requiring human approval for high-impact agent actions. Correlate MCP server telemetry with agent behavior signals in your SIEM to detect anomalous sequences. · source

What just shiftedIAM-18 · 2026-07-19

Agentic AI Runtime Attack Surface Expands: MCP Compromise and Agent-to-Agent Trust Abuse Emerge

A July 2026 enterprise security guide from NeuralTrust documents six emerging attack paths against agentic AI systems that traditional security tools cannot detect. These include prompt injection via tool outputs, indirect prompt injection through retrieved content, memory poisoning, privilege escalation across agent chains, MCP server compromise, and agent-to-agent trust abuse. The WASP benchmark found that simple human-written prompt injections partially succeeded in up to 86 percent of cases against realistic web-agent workflows. Traditional security tools inspect code, network traffic, and known indicators of compromise but cannot inspect the natural-language instructions and evolving internal state that drive agent behavior. This re-prioritizes IAM-18 controls on agent tool access toward runtime enforcement rather than static configuration.

Sharpens: Implement agentic runtime security controls that inspect natural-language instructions, tool call parameters, and agent context before actions execute. Validate that every tool invocation matches the agent's declared purpose and least-privilege scope. Monitor MCP server tool descriptions for tampering and validate tool responses for injected instructions. Establish agent identity boundaries that prevent compromised agents from passing manipulated tasks to peer agents with broader permissions. Add runtime enforcement that revalidates authorization at every agent-to-agent interaction point. · source

New way to build itLOG-15 · 2026-07-19

Microsoft Formalizes AI Observability as Secure Development Lifecycle Release Requirement

In March 2026, Microsoft published guidance making AI observability a formal release requirement within their Secure Development Lifecycle (SDL). The guidance introduces two new observability components beyond traditional logs, metrics, and traces: evaluation (measuring response quality, grounding, and tool-use correctness) and governance (using telemetry to verify and enforce acceptable system behavior). Key innovations include context provenance tracking that captures which input components were assembled for each run, agent lifecycle-level correlation that propagates stable conversation identifiers across multi-turn interactions, and trust-boundary violation detection that identifies when untrusted external content influences agent behavior. This maps to AICM control LOG-15, which requires logging and monitoring all input and output events for AI models.

Sharpens: Instrument your AI systems to capture context provenance metadata for every request: which system instructions, developer templates, user inputs, tool outputs, and retrieved documents were assembled into the final prompt. Implement agent lifecycle-level correlation by propagating a stable conversation identifier across all turns, tool calls, and sub-agent invocations within a single user session. Add AI-specific observability signals to your existing OpenTelemetry pipelines: token usage per source, retrieval volume, tool call sequences, and trust-boundary crossings. Make observability a release gate: if you cannot reconstruct an agent run end-to-end from logs and traces, the system is not production-ready. · source

Control ids above refer to the CSA AI Controls Matrix (AICM).

53% → 100% catch on a fitted guard.

26 controls on your primary list; prove the fitted guard before the pipeline trusts the gate.

Open AI Sec & SafetyRead the fitted-guard prove
Every number above has a method page behind it: each piece opened up as inputs → mechanism → outputs, with provenance — and the deeper tables named, content owner-gated.The method, piece by piece →

Not your role?

Each role has its own way in. Here is where the others start.