Prompt injection, excessive agency, MCP supply-chain, authz chaining to backend compromise. Owned, and ahead of the syllabus on the MCP authorization gap: Agent Permission Guardrails ("the bottleneck is permissions, not model performance"), Containment Mapping, Four-Boundary Spec Mapping.

Tainted Data in LLM Pipelines owns the data half — untrusted input read by an agent becomes injection. The artifact half is absent: no note owns dependency provenance (sigstore, cosign, SLSA, SBOM, pinned installs). The worked example is an installer that writes unpinned, auto-accepted instruction content into every agent directory — injection with a package manager as the delivery vehicle, arriving before the agent starts. The strongest gap.

The trainings list judge-LLM workflows; the conference talk LGTM: Bypassing an LLM Build Gate (see the overview) shows a judge gate defeated without injection. LLM Evaluation is dated 2024 and benchmarks models, not judges; Visibility is Verification argues against trusting a judge but does not treat when judges fail; Elenctic Vibe Code Review is human-in-the-loop. Genuine gap — and the one where the raw material is already assembled.

Code-Graph MCP Survey, AI Agent Tool Systems, Agent Telemetry Systems, Agent Deployment Systems. Covered as construction; the attack surface of an agentic tool has no threat model yet. A section in an existing note, not a new one.

Agent Identity and Attestation connects identity delegation (git trailers, Co-Authored-By) to compliance attestation and the EU AI Act (Article 50) — the course syllabus with a regulatory citation already attached.