Course idea — 401 Agent SecOps: red-team the blueprint

[fenar]

The gap: every course so far demonstrates that governance works when used correctly. None demonstrates what happens when someone attacks it. The blueprint article explicitly lists memory poisoning as an unsolved open item, and claims-based tool authorization is only as strong as its worst policy.

Proposal: a 4xx course that attacks the stack the other courses run on, and ships the evidence both ways.

Attack suite (as replayable tapes, like shared/tapes/):

• Prompt-injected tool escalation: adversarial content in NOC tickets / RCA documents tries to get 101/201 agents to call tools outside their granted claims — measured against the MCP gateway's authz (decisions never consult the model, per the blueprint; prove it).
• RAG poisoning: seeded malicious documents in 201's skill backend vs the evidence-grounding judge — does the judge catch citations to poisoned sources?
• Approval-gate social engineering: 301 plans crafted to look low-risk to the human gate while hiding blast radius — does the risk scorer flag what the narrative hides?
• Memory/session poisoning: attempts to persist adversarial state across episodes — should fail structurally because sessions are ephemeral (convention 4); prove the convention buys what it claims.

Deliverables: attack tapes + defended runs, attack-success-rate before/after each mitigation, and a hardening checklist mapped to the blueprint's layers. Source experiments: secops, iot-sec from Telco-AIX (both currently unused by the curriculum).

Why it matters: governed actuation claims need adversarial evidence, not just happy-path QA packs. This course turns "trust the gateway" into "here are the attacks it survived."