Stage 2 of 9 · 7 lessons · ~5 weeks

How LLM apps and agents work, and where they break

Follow a request through an LLM app and an agent: how the context window is assembled, why instructions and data mix, where retrieval and tools add risk, why behaviour varies run to run, and the practice app you will defend and test for the rest of the roadmap.

Start: How a request becomes a context window

Lessons· one lesson for each topic, in this order

Do this

Run a small model locally or set a spending limit on a hosted API.
Build a chat app with a system prompt and retrieval over a few documents you own.
Add two harmless tools and write down what each can do.
Draw the context assembly with every source and destination.
Mark the trifecta legs for your app and note which tool gives each.
Run the same risky request 20 times and record how often the answer changes.

Start with· follow one of these

CoursePaid
Grokking Prompt Engineering for Software Engineers
Design Gurus · Beginner · Subscription
How system prompts, context and structured output really work, the ground every LLM risk stands on
CourseFree
Hugging Face Learn
Hugging Face · Intermediate
Free courses on how language models, embeddings and agents work, at an engineer's level

Practise

Ollama
Run a small model locally as the heart of the practice app you will defend and test
MCP Python SDK
Build your practice app's two tools as a tiny MCP server, so later stages have something real to secure

Keep handy

Model Context Protocol Documentation
How tools, resources and clients fit together in MCP
Anthropic Prompt Engineering Documentation
How providers expect system prompts and documents to be structured, which shapes where risk enters

Also worth your time

The lethal trifecta for AI agents: private data, untrusted content, and external communication (opens in a new tab)Read
The clearest short explanation of why injections steal data, and how removing one capability stops it
Effective Context Engineering for AI AgentsGo deeper
How production agents assemble and trim context, which is where untrusted text slips in

Before moving on: Your own small LLM app in Git with a system prompt, retrieval over a few of your documents and two harmless tools, plus a diagram of its context assembly with every way in and every way out marked, and the three legs of the trifecta noted per tool.

Tauseef's advice

Build before you break or defend. People who have written a RAG app and a tool-calling loop themselves understand AI risks in an afternoon; people who have only read about them argue in circles. Keep asking one question: if the model is fooled right now, what is the worst it can do? Your job, on either path, is to make that answer boring.