owasp
3 free lessons tagged owasp across AI, Computer Science. Each one is a short sequence of focused steps with narration and a five-question quiz at the end — take them in any order, no signup required.
The LLM Threat Model: Why the Model Cannot Defend Itself
Guardrails exist because a language model cannot reliably distinguish instructions from data. This lesson builds the threat model: the OWASP Top 10 for LLM Applications, direct and indirect prompt injection, jailbreaks, data leakage, and why tool-using agents turn a content problem into a security one.
How web applications actually get hacked
Most technical breaches trace to one root cause: an application trusting input it should not. Walk through the real vulnerabilities with concrete code, SQL injection, cross-site scripting, broken access control, and vulnerable dependencies, seeing exactly how each is exploited and, just as concretely, how each is fixed. Practical, example-driven, and defense-focused throughout.
Prompt injection: the security flaw at the heart of LLM apps
Why LLM apps are uniquely vulnerable to attacks delivered as plain text, the difference between direct and indirect injection, and the defences that actually help (plus the ones that don't).