Build the RAG API with retrieval

1. 01

   Concepts & system design

   60 min· read · map the mechanismtimer

   R04 — OWASP LLM01 & LLM08 Vector/Embedding weaknesses

   R41 — OWASP Agentic excessive agency

   Read the assigned sections; map the mechanism, threat model and trade-offs.

2. 02

   Project implementation

   120 min· build · integrate · debugtimer

   Build the end-to-end RAG query API (pre-filtered retrieval context assembly with XML/JSON untrusted-data delimiters grounded generation).

   Build, integrate, debug and improve the increment in the active project.

3. 03

   Security lab

   60 min· attack your own systemtimer

   Insert an indirect prompt injection payload inside a sample document; verify the generator treats retrieved chunks strictly as passive evidence, never as system instructions.

   Test the abuse case, failure path, authorization bypass or resource limit.

4. 04

   Verification & evidence

   30 min· test · record evidencetimer

   Retrieval indirect-injection regression test suite.

   Add or run regression tests; record the 9-point evidence record.

5. 05

   Deliberate practice & Socratic review

   30 min· explain aloud · update gapstimer

   Answer the 8 Socratic questions without notes: What? Why? How? What if? Why not? How can I prove it? Where can it break? What have I learned?

   Re-explain the hardest concept aloud, inspect one edge case, update the gap log.

6. total5 h

• R04OWASP Top 10 for LLM Apps↗ genai.owasp.org

  Prompt injection, sensitive info disclosure, improper output handling, excessive agency, vector weaknesses, unbounded consumption.

• R41OWASP Agentic AI Resources↗ genai.owasp.org

  Agentic threat taxonomy: tool misuse, excessive agency, memory poisoning, inter-agent trust, and human oversight.

Read only the named sections needed for today's task. Reading sits inside the 60-minute concepts block; it is not extra time.

• docsOWASP Gen AI Security Project · risk chapter
  LLM01:2025 Prompt Injection - OWASP Gen AI Security Project

  Separates direct from indirect injection and stresses that retrieved content is untrusted input, the rationale for delimiting assembled context as data rather than instructions.

  R04unchecked 2026-11-11
• articleMicrosoft Learn · guidance article
  Defend against indirect prompt injection attacks

  Gives concrete handling rules for untrusted retrieved content, including delimiting and least-privilege output handling, which is what context assembly has to implement before generation.

  R04R41checked 2026-11-11
• videoSimons Institute for the Theory of Computing · 43 min
  Defense against prompt injection attacks

  Argues from the structural separation of instructions and data, including structured-query designs that keep retrieved text out of the instruction channel.

  R04checked 2026-11-11
• videoSecureTechIn · 11 min
  AI Security Lesson 13: Prompt Injection Defense Explained for Teams

  Lays out the three defense patterns including delimiters that mark untrusted input, directly usable in the XML/JSON wrapping step of the RAG query API.

  R04checked 2026-11-11
• labOWASP · hands-on labs
  AI Vulnerabilities Playground | OWASP Foundation

  Hands-on exercises against deliberately vulnerable LLM apps so you can try injected retrieved content against your own assembly and grounding logic.

  R04R41checked 2026-11-11

A lab is complete only when it produces evidence. Installing PyRIT, Garak, Presidio or TransformerLens is not completion. Saved on this device only.