Cybersecurity is, of course, a massive topic, and there are entire courses devoted to nothing else.
And my MLOps AI and production course covers a bunch of it.
I just wanted to cover one super important point with you, and it's specifically about Agentic AI.
A lot of cybersecurity topics apply to any software and are very similar when working with AI or any
other times when you're running software and interacting with third parties.
But there is one particular vulnerability with Agentic AI that is different, that is unique, a particular
vulnerability.
And it was it was popularized by an incredible writer, Simon Willison, who's a combination of a of
an engineer, a journalist, a speaker, and his blog is incredible.
And I will put a post to this, a link to this in the course resources as well.
And he coined the term the Lethal trifecta for the particular vulnerability that is opened up by an
Agentic AI platform, such as the ones that we work on in, and such as the one that we'll be working
on for the capstone project too.
So it's something that is important to be aware of.
And in particular, the lethal trifecta is a scenario that happens when your AI agent has three characteristics.
Hence trifecta.
And if your AI agent only has two of the three or only one of the three, then whilst it might have
all sorts of vulnerabilities, as with any other piece of code, there isn't necessarily this one big
extra vulnerability that applies specifically to Agentic AI.
And here are the three.
The first of them is if you build an agentic platform that has access to data that is private, something
like your bank account or your sales numbers or anything that is secret data that you wouldn't want
out there.
That is the first of the of the pieces, first of the pillars or whatever, the first bubble of this
diagram of the lethal trifecta on its own, that needn't be a problem.
If you have an NLM with access to private data, then it's just going to generate some tokens.
Tell you about the private data.
That in itself is not considered a problem.
OpenAI could leak the data for sure, but then you they are a Soc2 compliant company.
You have a relationship with them.
They they have very tight information security policies.
And by the way, you have a relationship with Google for your Gmail as well, which has got nothing
to do with AI.
So having third party dependencies is something that we're very familiar with.
It's not in itself a new vulnerability.
Okay.
That is the first of the of the three.
All right.
And the second one is the ability to communicate externally.
So is this agent able to give information to someone other than you.
Is it able to give it to me.
So does it have access to your private data like your Pin code of your of your, of your bank, of your
cashpoint ATM card.
And it has the ability to talk to me.
That's the second thing.
Now, you might think that already sounds like really bad news.
If there's something which has access to my Pin number and can talk to it.
Uh, devious as I am, I no doubt I'll want to get access to that, but but bear in mind that in itself
that needn't be a problem.
There are many, many systems that handle private data and have multiple users and deal with it just
fine.
And if you wrote this software and you were responsible for all of it, then you know what this LM call
is doing.
And you can make sure that it's not going to be revealing that your Pin code to me, because that's
not how you'd be setting up the prompts.
It's not what it would do.
So in of itself, this this blue and purple bubble needn't be a particularly grave problem.
And then we add in the third one exposure to untrusted content.
What does that mean?
Well, I just mean that this Agentic platform, some of its input, some of what goes in that input
context didn't come from you.
It came from somewhere that could be completely harmless.
Maybe there's an MCP tool in there that it's using where it's getting the natural language descriptions
of what to do.
Maybe it's something which is scraping the web for extra information, but somehow it has access to
stuff that didn't originate from you.
And it's not necessarily content that you trust that you know, you can guarantee is what you want it
to be.
That is the third piece of the puzzle.
And if all three pieces apply, then potentially you could have a problem.
You have a vulnerability.
The lethal trifecta, as Simon calls it, because it's possible that that untrusted content could contain
something which could deceive your LLM into exposing that private data to a third party.
And that is the gotcha here.
And there've been a few.
well, well publicized a genetic AI issues in the last year or so.
And I think one of them that's quite, quite well known was from GitHub.
And the GitHub is the place where people manage their code, the software that's been written and GitHub
had built an MCP server, a set of tools that would allow you to write agents that could that could
read and write from your your code, your repos.
And there was, uh, it could have access both to your public repos and to your private repos, so that
if you wished you could you could use it to dig into your private repos and also your public repos,
but only you had access, so it seemed completely fine.
Um, but but it did tick all three boxes of this because the public repos could contain any information
put in there, and external users could do these things called PR reviews.
They could, they could.
There was a route where they could just put stuff in comments that would be read by the LLM.
It had access to private data because it had your private code, which might include things like your
API keys in various places linked to your credit card, that kind of stuff.
And it had an ability to communicate externally that no one thought of, because it could also respond
to comments written in the public repo.
And this may, you may or may not be following me.
It's not that important.
But maybe if you do, you can see you can connect the dots and see how that could result in problems.
And you can Google it and read about what actually happened and see more.
And there are there are other examples of where the lethal trifecta has has come to light.
And you can read Simon's original.
He's got a presentation on it, which is a great read as well.
So that is the Lethal Trifecta.
It's something to watch for when you build out your workflows.
We'll be watching for this carefully in the next two days as we build out the capstone project.
There it is.
Just a market.
There is the skull and crossbones.
That is the thing you want to avoid.
Okay, enough.
Enough of the worrying.
Let's talk about what it takes to make a great agentic AI solution.
And in some ways, this section is like the main takeaway for the whole all of the all the purple days,
all of the core learning comes comes to this.
What makes a strong agentic solution, particularly building it in Nan.
I'm going to start with what doesn't make a strong agentic solution the Anti-patterns.
And the first of them is the thing I called the human trap, the anthropomorphizing the time when you
see people just coming up with agents because they sound like that's a great agent to make.
Don't do it.
Uh, and the other red flag is when people are too solution focused.
They say, I want an agent to do x.
I don't mean x, as in the thing formerly known as Twitter.
I mean x where x is something that you want.
I want an agent for X.
Don't tell me that you want that solution.
Tell me what the business problem is you're trying to solve, and then we'll see if agents are right
for it or something completely different.
And the third red flag is a bit harder to explain, but it's when when people see that the the end goal,
what they're what they're trying to achieve is simply having an agent that generates content in some
way, like like you have an agent that's called a strategy agent.
And what it does is it generates company strategy.
And as a result, they say, great, I built my strategy agent.
I prompted it to make a company strategy, and it's creating a company strategy.
We're done here.
And that I also see a lot.
Uh, maybe not with company strategy, but but with with other things.
Our sales numbers aren't good enough.
We need a sales strategy agent that's going to read in all the information and produce a sales strategy.
And that output is is the the result.
And then we will we'll deploy it and show people our sales strategies.
That's that's not going to work because llms are designed to generate plausible content.
That's what they do.
That's what they're trained for.
They are trained to generate plausible content.
That doesn't mean that the content is necessarily correct.
It just means it's plausible.
It looks good.
It feels right.
That's what they're trained to.
And it's okay for AI users to complain that an LLM is hallucinating coming up with with things that
are incorrect.
But it's not okay for you and me to complain about that because we know better.
We know that llms aren't built to be accurate.
They're built to be plausible.
Making them accurate is our job.
That's what we do.
That's what the AI engineer or the or the AI builder is designed to do.
We are designed to make this this product achieve our business goal.
The LLM is there just to generate plausible outputs.
Okay.
So after saying what doesn't work, what am I saying does work.
It is of course largely the flip of the Anti-patterns.
First up, a clearly identifiable business problem.
Don't say we need a sales strategy.
Say we need more revenue.
Something that is revenue is too low.
That is a problem that needs to be fixed.
We need more sales.
Uh, something that's very concrete and specific.
And then you need a metric, a way or multiple metrics, ways to evaluate whether or not your agentic
AI is achieving your goal.
And with criteria that you establish in advance, you say, this is what we're shooting for.
This is what we would call success.
And so you have that clearly identified upfront.
You know how you will measure success and you know what success looks like.
We need our sales figures to be here.
And they are here.
And, uh, all we need are head of sales to be approving all of the plans that, that come out of,
of our group.
Something that's a bit more immediate and direct, but a bunch of these metrics that are very clear
and measurable.
And finally, you need to test to make sure that you've actually achieved your success criteria and
that you evaluate well.
And this ties to the to the points I made before the last of the Reds.
So we know that LMS are built to generate plausible content.
That's what they do.
That's what they're built for.
Our job is to go from plausible content to accurate content, and the way that we do that is by having
a metric, by testing and proving that we achieve it, and then if not putting in place the kinds of
controls, the extra tools, the extra checks and balances and extra agentic loop whatever it takes
until we're not just generating plausible content, we're generating accurate content.
And that is our job.
Our job is going from plausible to accurate.
It's through developing the metric and testing it that we get from just a plausible agentic solution
to a strong, high performance, agentic solution that actually achieves the business goals.