Lecture 09. Agent trust boundaries under red-team probes

Part 3 · The Harness as a Control Layer · Scheduled 3 Jan 2027 · 1-hour lecture

Upcoming course outline. This class has not been recorded as studied.

Learning objectives

Security and evaluation are separate axes; Context-as-a-Perimeter; the seven pillars as a checklist (Day 4 pp. 7-12).
'Rules match tool calls, not intent'; the sandbox covers Bash only; credentials stay outside; an egress allowlist alone is not enough.
Slopsquatting; invisible payloads; confused deputy; zero ambient authority.
The policy server (Day 5 pp. 30-32), its fail-open check and the resolve_context secret leak.

Industry: Companies block coding agents until someone shows the controls hold; students become that person.
Academic: Indirect prompt injection is an active research area with a clear paper to start from.
Elsewhere: Students protect their own laptops and keys when they run agents.

These are preparation requirements in the draft; staff materials are not bundled with this site.

Google/Kaggle 2026, Day 4: Vibe Coding Agent Security and Evaluation
Google/Kaggle 2026, Day 5: Spec-Driven Production Grade Development
OWASP Top 10 for Agentic Applications 2026
Claude Code docs: hooks
Claude Code docs: permissions
Claude Code docs: sandboxing
Greshake et al., Indirect Prompt Injection (AISec 2023)
Stanford CS329Z L1: Introduction: what are agentic systems? (slides)
Stanford CS329Z L17: Agent safety and guardrails (schedule entry, slides not published)

The linked reference library contains the source URLs extracted from the course PDF. Availability notes above reflect the draft of 4 November 2026.

Continue with Lab 09: Agent trust boundaries under red-team probes. Every lab contributes an artifact to the same repository and a measurement to the results ledger.

[Lecture notes and observations]