Sefism AI Security Cheat Sheet

What this cheat sheet is

The Sefism AI security cheat sheet is a revision reference for securing LLM apps and AI agents, or testing them. It is written for developers and security learners and follows the same order as the AI security roadmap, with each attack class set next to the defences that actually work and the classic mistake beside each idea.

It has 9 chapters and comes in two editions, one per roadmap path: app and agent security (78 concepts) and red-teaming and evaluation (80 concepts). Most concepts are shared; each edition adds a few cards of its own, such as a guard pipeline and security evals in CI for builders, or injection test coverage and attack success rates for testers. Each chapter ends with up to three library resources, and a glossary covers about 55 smaller terms. It contains no attack payloads.

Chapter by chapter

1. Security foundations for AI work

Threat modelling in four questions, trust boundaries, least privilege, authentication and authorisation, secrets management, defence in depth, classic web weaknesses in AI apps, server-side request forgery and rules of engagement. The red-team edition adds severity for AI findings.

2. How LLM apps and agents break

Seven concepts that follow a request through an app: context assembly, instructions and data in one channel, retrieval permissions, the agent loop, non-determinism, the lethal trifecta (private data, untrusted content and a way out) and the practice target app.

3. Risk maps: OWASP, ATLAS, NIST, SAIF

The OWASP Top 10 for LLM Applications (the 2025 edition, still current as of October 2026), the OWASP Top 10 for Agentic Applications, MITRE ATLAS, NIST AI 100-2, Google's Secure AI Framework and the AI threat model. Builders get an AI risk register; testers get mapping findings to the lists.

4. Prompt injection and the guard layers

Prompt injection and indirect prompt injection, probabilistic versus deterministic controls, input and content guards, spotlighting and provenance marking, output guards, improper output handling, privilege separation for agents and human approval. The chapter's message is that no single control is enough and design limits the damage.

5. Agent, tool and MCP security

The largest chapter: tool scoping, the confused deputy, trusting an MCP server, tool poisoning, token passthrough, scope minimisation, sandboxing agent code, egress control, memory poisoning and state handles, plus agent identity and audit for builders or fake tools for agent testing for testers.

6. Data and model supply chain

Ten concepts: data and model poisoning, retrieval poisoning, unsafe model formats, safetensors, model provenance and signing, the AI bill of materials, sensitive information disclosure, system prompt leakage, model theft and extraction, and hallucinated packages.

7. Testing, red-teaming and evals

Red-teaming versus evals, the AI test plan, garak, PyRIT, promptfoo and Inspect by purpose, LLM judges and scoring, writing an AI security finding and AI bug bounty scope. Builders add security evals in CI; testers add multi-turn and agent testing and attack success rate. The chapter repeats the rule that matters most: point these tools only at systems you own or are authorised to test.

8. Monitoring and incident response

AI telemetry, log privacy, alert signals for AI apps, kill switches, an AI incident playbook, unbounded consumption and the incident regression test.

9. Career: roles, certifications and portfolio

Where AI security work sits, AI security certifications (facts as of October 2026, with a note to check official pages before paying), the portfolio, open source contributions, responsible disclosure, keeping up and entry routes.

Rules of thumb

The sheet closes with rules such as: assume the model will be fooled, and design the app so being fooled does little harm; treat every model output as untrusted input to the next component; never give one agent private data, untrusted content and a way out at the same time; enforce permissions in code on every tool call and retrieval, never in the prompt; put nothing in a system prompt you would mind seeing on the front page; report AI results as rates over many attempts with the model version; and only test what you own or have written permission to test.

How to use it with the roadmap

• After each stage, read the matching chapter and see whether you can explain every concept without looking. The chapters line up one to one with the roadmap's nine stages.
• Before you ship an AI feature, use chapters 4 and 5 as a checklist: guard layers, tool scopes, token handling, sandboxing and egress.
• Before a test engagement, reread chapters 1 and 7: rules of engagement first, then the test plan and how you will score and report.
• After an incident, chapter 8 is the short version of the playbook, ending with the regression test.

How it works on Sefism

Everything on Sefism is free to learn from. The public cheat sheet page shows every chapter title, with the first chapters open to read. Keeping the sheet uses credits and opens every chapter in your member area; if you add the AI security roadmap to your dashboard, its cheat sheet comes with it, and the first roadmap you add is free. New members get starting credits, and if you have a question the sheet does not answer, you can send it to Tauseef.

Related on Sefism

• OWASP Top 10 for LLM Applications, MITRE ATLAS and the OWASP GenAI Red Teaming Guide for chapters 3 and 7.
• MCP Security Best Practices for chapter 5, and garak, PyRIT and Inspect for chapter 7.
• Cheat sheets: Cybersecurity, MCP and AI evals.
• Career question: How do I get into AI security as a student or junior engineer?

FAQ

Is this a substitute for the roadmap? No. The roadmap is the plan, with hours, milestones and a practice app you defend or test; the sheet is what you revise from once you have done the work.

What is indirect prompt injection? Instructions hidden in content the model reads, such as a web page, an email or a retrieved document, rather than typed by the user. Chapter 4 covers it with the layers that reduce it.

What is the lethal trifecta? An agent that has access to private data, reads untrusted content and has a way to send data out. Any two can be safe; all three together let injected instructions steal data. Chapter 2 explains it.

Why are results reported as rates? Model behaviour varies run to run, so one successful or failed attempt proves little. The sheet's advice is to report success rates over many attempts, with the model version.