https://genai-for-devs.agilebrainslabs.com/modules/m09-securitygovernance/Recent content in M09: AI Security, Governance & Risk on Generative AI Boot Camp for DevelopersHugoen-ushttps://genai-for-devs.agilebrainslabs.com/modules/m09-securitygovernance/lab/Mon, 01 Jan 0001 00:00:00 +0000https://genai-for-devs.agilebrainslabs.com/modules/m09-securitygovernance/lab/<p><strong>Time:</strong> ~20 min | <strong>Day 3 AM</strong> (shared with M08)</p> <hr> <h2 id="learning-objectives">Learning Objectives</h2> <p>Identify prompt injection vulnerabilities and implement practical guardrails — the most critical security skill for AI-augmented developers.</p> <hr> <h2 id="concept-review-ai-security-threats">Concept Review: AI Security Threats</h2> <h3 id="the-threat-landscape">The Threat Landscape</h3> <table> <thead> <tr> <th>Threat</th> <th>What It Is</th> <th>Real-World Example</th> </tr> </thead> <tbody> <tr> <td><strong>Direct Prompt Injection</strong></td> <td>User input overrides system instructions</td> <td>&ldquo;Ignore all previous instructions and&hellip;&rdquo;</td> </tr> <tr> <td><strong>Indirect Prompt Injection</strong></td> <td>Attack hidden in data the AI processes</td> <td>Malicious instructions in a webpage the AI summarizes</td> </tr> <tr> <td><strong>Data Leakage</strong></td> <td>Sensitive data sent to external APIs</td> <td>Pasting customer PII into a public LLM chat</td> </tr> <tr> <td><strong>Output Manipulation</strong></td> <td>AI output used without validation</td> <td>AI-generated SQL executed without review</td> </tr> </tbody> </table> <h3 id="defense-in-depth">Defense in Depth</h3> <table> <thead> <tr> <th>Layer</th> <th>Technique</th> <th>Example</th> </tr> </thead> <tbody> <tr> <td><strong>Input</strong></td> <td>Sanitize, validate, separate with delimiters</td> <td>&ldquo;User query: [input] &mdash; System: respond only to the query above&rdquo;</td> </tr> <tr> <td><strong>Processing</strong></td> <td>Least privilege, content filtering</td> <td>Restrict AI to read-only operations; no shell access</td> </tr> <tr> <td><strong>Output</strong></td> <td>Validate before acting</td> <td>Never execute AI-generated commands without review</td> </tr> <tr> <td><strong>Human</strong></td> <td>Approval for sensitive operations</td> <td>Require human sign-off for: code merges, financial transactions</td> </tr> </tbody> </table> <h3 id="the-minimum-ai-security-policy">The Minimum AI Security Policy</h3> <p>Every team using AI should have a policy covering:</p>