Apps are shipping LLMs — and a new attack surface

Mobile and web apps now embed language models everywhere: in-app chat, "summarize this", smart replies, copilots, autonomous agents that call tools and APIs on the user's behalf. Each feature wires an unpredictable, instruction-following model into your trust boundary.

🛡️ This is a defensive course. You learn how AI features break so you can test and harden your own apps. No weaponized payloads — concepts, challenges, and fixes.

How apps embed AI (the shapes you'll test)

Thin wrapper — app forwards user text to a model API, shows the reply.
RAG — app retrieves documents and stuffs them into the prompt as context.
Agent / tool-calling — the model decides which functions, APIs or MCP tools to invoke.
On-device — a small model runs locally (CoreML / TFLite) with app data in scope.

The core lesson: the model treats data as instructions. Any text it reads — user input, a web page, a retrieved document, a tool result — can try to steer it.

🎯 Challenge: For a travel app with an in-app "trip planner" chatbot that can read your saved bookings and send emails, name three places untrusted text could enter the model's context.

Show solution

(1) The user's own chat input; (2) retrieved content — booking confirmations, hotel descriptions, web pages the planner fetches; (3) tool results — an email it reads, an API response. All three are untrusted. The email-sending capability makes this an agent with real side effects, so a malicious instruction hidden in any of those sources could drive an action. Remediation starts with treating every non-system token as data and gating side-effecting tools (covered later).

Liked it? 11 more lessons are waiting.

12 lessons · knowledge checks · final exam · verifiable certificate

Unlock all courses · CHF 9/month Buy only this course · CHF 19

What's in AI-Integrated App Security

1. AI-Integrated App Security & Why It's DifferentFree
2. The OWASP LLM Top 10 — Your Map🔒 Foundations
3. Prompt Injection — Direct & Indirect🔒 Core
4. Jailbreaking & Guardrail-Bypass Concepts🔒 Core
5. Insecure Output Handling🔒 Core
6. Sensitive-Info Disclosure & Data Leakage🔒 Attack Surface
7. Excessive Agency & Tool Abuse in Agent Apps🔒 Agents
8. MCP & Tool-Calling Server Security🔒 Agents
9. RAG & Vector-Database Security🔒 Attack Surface
10. Model & Endpoint Abuse — Cost and DoS🔒 Attack Surface
11. Defending AI Features — Defence in Depth🔒 Defense
12. Assessing an AI-Integrated App — Practical🔒 Capstone

Continue in the interactive course reader →

AI-Integrated App Security & Why It's Different

Apps are shipping LLMs — and a new attack surface

How apps embed AI (the shapes you'll test)

Liked it? 11 more lessons are waiting.

What's in AI-Integrated App Security