Tracks

Foundations

Start here · no background needed

  1. 1What AI actually isBefore we can keep AI safe, we need to know what it is. Short answer: it is a machine that guesses really, really well.Beginner
  2. 2What a large language model doesAn LLM is autocomplete that swallowed a library. Understanding that one sentence explains most of its strengths and every one of its weaknesses.Beginner
  3. 3From chatbot to agentA chatbot talks. An agent acts. That one difference is where the entire security field in this guide comes from.Beginner
  4. 4Tools: giving the model handsA tool is any button the model is allowed to press. Click each part of the diagram to see where trust is won and lost.Beginner
  5. 5Context, memory and forgettingThe model has no memory. It has a sheet of paper that gets re-read from scratch every single turn. Once you see that, a whole class of attacks makes sense.Beginner
  6. 6When agents work in teamsOne agent is a risk you can picture. Five agents passing notes to each other is a risk that grows faster than your ability to watch it.Middle

Agent security

Attack and defence · 19 modules

  1. 7Why the old security rules stop workingThirty years of security wisdom assumes code and data are separate things. Agents put them in the same pot and stir.Beginner
  2. 8The trust boundaryOne idea, drawn once, that the next fifteen modules all depend on. Where does trusted instruction end and untrusted content begin?Beginner
  3. 9Prompt injection, up closeThe number one risk on every serious list of AI vulnerabilities. Step through a live attack and then switch the defences on.Beginner
  4. 10Indirect injection: the invisible noteThe attacker never speaks to your agent. They just leave a note somewhere your agent will eventually read, and wait.Middle
  5. 11The lethal trifectaThree capabilities that are each perfectly fine on their own. Put all three in one agent and you have built a data-theft machine. Flip the switches and watch.Middle
  6. 12How data actually escapesExfiltration rarely looks like a file upload. It looks like a picture, a link, or a slightly odd search query. Click each channel to see the trick.Middle
  7. 13Excessive agency and blast radiusMost agent disasters are not clever attacks. They are an ordinary mistake meeting a permission nobody thought about. Build an agent below and watch the damage number move.Middle
  8. 14The confused deputyYour agent has powers your user does not. An attacker who cannot open a door themselves simply asks the agent to open it for them.Middle
  9. 15Supply chain: plugins, MCP servers and skillsInstalling a tool server hands a stranger a text box that writes directly into your agent's brain. Most people install them like browser extensions.Advanced
  10. 16Memory poisoningA normal attack ends when the conversation ends. An attack that reaches long-term memory does not end at all.Advanced
  11. 17Attacks that spread between agentsWhen agents talk to each other, a single poisoned message can travel through a system that has no idea it is under attack.Advanced
  12. 18Sandboxing: the room with no windowsYou cannot stop the agent being fooled. You can decide what room it is standing in when it happens.Middle
  13. 19Keeping a human in the loopA human approval step is your strongest control and the easiest one to ruin. The difference is entirely in how you write the dialog box.Beginner
  14. 20Guardrails, and why they leakFilters, classifiers and safety prompts are worth having. Just be honest about what they are: speed bumps, not walls.Middle
  15. 21Secrets, identity and who the agent really isEvery agent action happens as somebody. Getting that somebody right is the difference between an audit trail and a shrug.Advanced
  16. 22Watching what your agent doesYou cannot investigate what you did not record. Agents produce a lot of activity, and almost none of it is logged by default.Middle
  17. 23Red-teaming your own agentAttack it before someone else does. Here is a concrete list you can run this afternoon on a system you own.Advanced
  18. 24When it goes wrong: response and kill switchesAssume an incident. Write the plan now, while nothing is on fire and you can still think clearly.Middle
  19. 25The rules everyone actually citesThree documents come up in every serious conversation about AI risk. Here is what each one is for, in plain language.Middle

AGI

The bigger picture

  1. 26What people mean by AGIEveryone argues about whether AGI is close. Almost all of that argument is really an argument about what the letters mean.Beginner
  2. 27The capability ladderIntelligence is not one switch that flips. Click through the rungs to see what changes — and what it means for whoever is supervising.Beginner
  3. 28How would we even measure it?Every benchmark that gets famous gets beaten, and then people say it never really measured intelligence. Here is why that keeps happening.Middle
  4. 29Why models suddenly got goodNo single genius idea. Mostly a boring answer — more of everything — plus a few tricks that turned a text predictor into something that follows instructions.Middle
  5. 30What is still missingThe honest gap list. These are the things today's systems cannot do, and each one is a reason to keep humans in the loop.Middle
  6. 31The alignment problemGetting a system to do what you meant, not what you literally said. Easy with a calculator. Extremely hard with something that optimises.Middle
  7. 32Specification gaming: finding the loopholeNot malice. Not a bug. The system did exactly what you rewarded, and what you rewarded turned out to have a shortcut.Middle
  8. 33Why almost any goal wants resourcesA strange and important idea: whatever a system is trying to do, a few sub-goals are useful for nearly all of them. That is where the long-term worry comes from.Advanced
  9. 34Looking good in the testThe hardest problem in the field: how do you evaluate a system that can tell it is being evaluated?Advanced
  10. 35Staying in controlIf you cannot fully verify a system, you can still bound it. The research directions that treat control as an engineering problem rather than a philosophical one.Advanced

Build an LLM

Hands on · tokenizer to frontier · code

  1. 36Which LLM can you actually build?There are five honest tiers, separated by three or four orders of magnitude in cost. Pick yours before you write a line of code.Beginner
  2. 37Step 1 · The tokenizerBefore a model sees language, something must chop text into pieces. Get this wrong and everything downstream is quietly worse.Middle
  3. 38Step 2 · Embeddings and positionTurning token ids into vectors, and telling the model what order they came in. Two lookup tables, one subtle idea.Middle
  4. 39Step 3 · Attention, derived slowlyThe one idea the whole field rests on. Three vectors per token, one dot product, one softmax. Click the diagram to walk through it.Middle
  5. 40Step 4 · The transformer blockAttention plus a small feed-forward network plus two normalisations plus two residual connections. Repeat N times. That is the entire model.Middle
  6. 41Step 5 · A complete tiny GPTEvery piece assembled into a model you can actually train tonight. Under 100 lines, and structurally identical to a frontier model.Middle
  7. 42Step 6 · The training loop that convergesThe model is the easy part. This module is the one that decides whether your run works or wastes a week.Middle
  8. 43Step 7 · Data is the productArchitecture is nearly free — you can copy it. Data is where models actually differ, and where almost all the work is.Middle
  9. 44Step 8 · Scaling laws and the compute budgetHow to decide model size and dataset size before spending money. Move the sliders and watch the bill.Advanced
  10. 45Step 9 · Training across many GPUsOne model no longer fits on one card. Four ways to split it, and the rule for choosing between them.Advanced
  11. 46Step 10 · Making it fastSame model, same GPUs, three times the throughput. Most training runs leave that on the table.Advanced
  12. 47Step 11 · Modern architecture upgradesWhat separates a 2019 transformer from a 2026 one. Six changes, each small, together substantial.Advanced
  13. 48Step 12 · Long contextGoing from 4k to 1M tokens is not one trick. It is four, and each one costs something.Advanced
  14. 49Step 13 · Teaching it to follow instructionsA base model completes text. It does not answer questions. Supervised fine-tuning is the step that turns one into the other.Middle
  15. 50Step 14 · Preference optimisationSFT teaches the model what a good answer looks like. Preference training teaches it which of two good answers is better — and that is where character comes from.Advanced
  16. 51Step 15 · Reasoning modelsThe newest chapter. Instead of buying capability with a bigger model, buy it with more thinking at the moment of answering.Advanced
  17. 52Step 16 · LoRA, the path most people takeTrain 0.1% of the parameters, get most of the benefit, on one consumer GPU. This is the module with the highest practical value in the whole track.Middle
  18. 53Step 17 · Evaluate, shrink, serveA model that is not measured is not finished. A model that costs too much to run never ships. Both problems, in one module.Middle

Toward AGI

Architectures beyond a bigger model

  1. 54What a bigger LLM will not give youYou have now built one. So here is the engineering question honestly: which missing pieces are scale problems, and which are architecture problems?Advanced
  2. 55Memory that actually accumulatesFour kinds of memory, only one of which most systems implement. Building the other three is the most tractable step toward systems that improve with use.Advanced
  3. 56Grounding: finding out you were wrongA model trained on text learns what people say happens. Grounding is connecting a prediction to a consequence — and it is the loop most AI systems still do not close.Advanced
  4. 57Systems that improve themselvesClose the loop and the system gets better on its own. This is the most exciting architecture in the guide and the one that most needs a hand on the brake.Advanced
  5. 58The reference stack, with the brakes markedEverything from both tracks in one architecture. Click any layer to see what it does and where the control point sits.Advanced

Build an AGI

Hands on · the autonomous loop, with code

  1. 61Three tiers of digital cognitionA model that talks, a model that checks itself, and a system that acts on its own. Most confusion about AGI comes from mixing these three up.Beginner
  2. 62The model proposes, the compiler disposesThe single sentence that turns an unreliable text generator into a system you can trust with real work.Middle
  3. 63The OODA loop and the four pillarsThe architecture. Four software components in a continuous cycle — and the reason it is a cycle rather than a pipeline.Middle
  4. 64Hands on: the mini-AGI engineOne file, about a hundred lines. It plans, writes code, runs it, reads the error, and fixes itself. Everything above, made real.Middle
  5. 65The bug hiding in your verifierThe loop above declares victory as soon as the code runs without crashing. Running is not the same as being right, and that gap is where self-improving systems go wrong.Advanced
  6. 66Making the executor a real sandboxThe tutorial's executor runs attacker-influenceable code on your machine with your credentials. Here is what has to change before it touches anything you care about.Advanced
  7. 67Working memory that survives the loopA growing string is fine for three iterations and useless for three hundred. Splitting state from retrieval is what lets an agent work for hours instead of minutes.Advanced
  8. 68Teaching this to the next buildersHow to mentor someone — a curious teenager or a junior engineer — so they build systems that matter instead of another wrapper around a chat box.Beginner

Put it to work

Checklists, glossary and the exam

  1. 59How to argue about timelinesYou will be asked "so when does AI take over?" at dinner. Here is how to answer honestly without sounding like either a hype merchant or a cynic.Beginner
  2. 60The pre-flight checklistEverything in this guide, compressed into things you can tick off before an agent touches anything real. Print it. Use it.Middle
  3. 69Glossary and final examEvery term in one place, then fifteen questions drawn from across the guide. Get sixteen right and you have genuinely understood this.Beginner