Back in twenty-twenty-one, I wrote an early blog piece about the use of this interesting, new-ish piece of technology called “GPT-2,” a generative text model. The Python API required quite a bit of work between manually pulling the model (no friendly Ollama desktop or hosted provider), training the model on a large corpus of Shakespeare, and then getting some kind of responses. At least in theory.

I ran this code snippet on an old, now defunct laptop, without a Cuda-enabled GPU. I trained it on about ten years’ worth of chat history from a conversation with a friend. It took fourty-eight hours to complete the training. The results were absolute nonsense.

Five years later, you can’t walk into public without hearing about LLMs.

What we call “AI” today is a huge abstraction. Most AI systems are agents: systems driven by Large Language Models, which are exposed to tools and knowledge corpi, and allowed to perform autonomous tasks. The most well-known agents are chatbots, but more autonomous systems, like OpenClawd, are starting to imply an era of fully autonomous black boxes.

For engineers, all of this means adjusting to changes in the industry. Vibe coding likely isn’t going anywhere (so long as it remains an affordable way to write code); models will evolve in capacity and capability; and fully automated agentic systems will continue to spread and automate, whether for better or for worse.

With that said, I argue that, in the face of these changes, it will continue to serve you to understand how these systems work and what you can do with them, without them, and in spite of them.

This second blog post of the year is dedicated to that subject.

This post provides an overview of some books I’ve encountered in the past year and how they’ve proven useful in this brave new world of AI integrations. Use this to decide where to start your journey. In addition, I wrote a couple of follow-up posts that cover code solutions and deep dives of how to operationalize this in security contexts.

Book #1: The Developer’s Guide to AI

Released: 2024, NoStarch Press, 320 pages

If you’re new to LLMs in development contexts, start with this one.

This book is a comprehensive survey on most AI development principles leading up to the middle of this decade. The book explores AI with respect to one-shots, multi-shots, chatbots, vector databases and RAG pipelines, model tuning (and when not to), and ends with some agentic considerations.

Overall, this book served as the best starting point for me personally. I was able to jump around chapters without missing too much context that couldn’t be searched in the meantime. Each chapter ends with one or more deliverables, so you will get a chance to build and explore AI concepts in piecemeal while progressively tying them all together.

The book explores different model frameworks, including those provided by the provider (example, the openai or anthropic packages). But the onus gradually shifts to ones with more capabilities and flexibility: Instructor, a powerful framework for one-shot and text extraction cases; Pydantic, a schema-definition framework which most providers can leverage under the hood (example, OpenAI’s Requests API); and a brief discussion on Smolagents’ code agent, a self-contained object for agents that use dynamic code generation to plan and execute tasks with multiple and complex steps.

These frameworks are well-documented, and you can (and should) read into them to extend the core ideas outlined in the book. But each deliverable follows a progression from simple proof-of-merit chatbots to more capable systems. This is a good approach for first-time LLM developers, and provides the reader with a chance to understand when you should and should not use one approach or the other.

It also provides practical guidance for nice use cases, such as model tuning. In the early days of generative AI, the conventional wisdom was to train the model with new information. With modern LLMs, this practice is largely moot; instead, you’re better off leveraging other systems (such as RAG) in order to expand the capabilities and knowledge of your model.

The book is around 400 pages. The final section is dedicated to agents, but it really isn’t the emphasis of the book. You’ll learn how to build a simple MCP server and, independently, a single code-engine agent.

In 2026, most IT professionals are using, not merely LLMs and a provider’s chat agent, but also desktop agents, like Claude. This dropoff in content depth is a big one, but only if you’re trying to expand your skillset to custom agents, multi-agent systems, and deep agents. The reader should take note of the MCP server, as you’re most likely to get the most out of custom integrations for your preferred desktop agent. I discuss MCP considerations in a later section of this post.

The agent discussion is something you’ll want to research with other books or documentation for other frameworks. Smolagents provides a simple way to start writing these systems. Other frameworks, like PydanticAI and LangChain/LangGraph, might serve as a logical next step as your use cases become more involved or more sophisticated. Designing Multi-Agent Systems might be a better fit if you find yourself at this crossroad. For multi-agent systems, Google also provides its own guidance and design patterns. This may become the topic of another blog post later.

Still, this book covers about 90% of what you really need to know today in order to be up-to-speed with building, testing, and securing AI systems. For offensive security practitioners, use this as a guide for full-code approaches to AI workflows (not agent workflows, which are highly autonomous and, but classical, deterministic testing workflows with LLM steps).

The takeaways from this book led to two further blog posts.

Book #2 Practical Deep Learning

Release: 2025, NoStarch Press, 584 pages

When people ask me, “What is AI,” I have defaulted to saying: numbers and predictions. It’s a bit flippant and might sound dismissive, but it’s really the only way to shield someone from a long diatribe of technical details. It’s also the most technically correct answer because of LLMs’ history as probability machines. This book is a workable introduction to that history.

Practical Deep Learning is to modern AI systems what The Silmarillion was to The Hobbit. It covers the entire history of machine learning, from classical ML and theory, through neural networks, deep neural networks, and ends with Large Language Models. The author’s expertise in the field of ML research shows and provides a solid backbone for understanding these concepts at a practical level. Unlike The Silmarillion, the content is fairly accessible.

Every chapter of the book works with the same dataset, which the practitioner creates in an early chapter. Each chapter provides a deliverable that applies a machine learning concept to the data. This is a sensible approach because it reinforces a core idea: the better you understand the dataset, the labels and the features, the better you’ll understand the capabilities and limitations of machine learning concepts for the task.

The author’s expertise shines in connecting the mathematical theory with both manual (for educaiton and understanding) as well as practical implementations, making generous use of well-known frameworks like Sklearn and PyTorch. By the end of each section, you will walk away with a workable understanding of the math.

Offensive Security engineers might wonder why the math matters at all.

Keep in mind that machine learning models and LLMs are, ultimately, glorified probability machines. When a model is designed, implemented, trained, and deployed, the outputs of these configurations (which are, again, built on math) will ultimately define how the model runs. Therefore, these parameters also serve as interesting attack vectors during penetration testing.

If the model is a probability engine, adversaries can use (and have used) statistical analysis techniques in order to bypass guardrails and undermine assumptions about what an attacker can do with the model in an application context. A brief overview of these includes the following:

  • Model theft
  • Data poisoning
  • Model backdoors

These attack vectors are generally covered in AI Security trainings. TryHackMe and HackTheBox both offer AI security training that explore them in greater depth.

Beyond attack vectors, Cybersecurity at large has benefitted from varying stages of machine learning over the decades:

  • Using ML to reduce false positives from SOC alerts
  • Malware classification using DNN principles
  • LLMs as a way to analyze or explain signals from SIEM

For me personally, this book was a good basis for understanding the progression of ML into an age where LLM agents are everywhere. It also helped address the fundamentals from different security-related DNN research, such as a talk from B-Sides Orlando 2024 and some lingering topics that we covered generally at university.

It also provides some much-needed context to different science fiction works from the 1960’s until now. Modern neural networks existed only in theory, and its research was stonewalled several times due to factors like the capability of technology and the availability of data. The modern internet and modern hardware (namely, GPUs) enabled those once-frozen bodies of research to develop into practical, operational systems, which exist everywhere, and have existed for over a decade.

We can appreciate how the humanities and literature fit around those discussions during eras when they could not be fully realized, from works like I Have No Mouth And I Must Scream, The Minority Report, The Ghost In The Shell, and The Matrix. (Controversially, I argue Solaris captures the spirit of modern-day LLMs without even realizing it.) While the realities of these fictions certainly look very different from how they were once speculated, the technical details behind ML, neural networks, and large language models can help us appreciate some truth behind each fiction.

Regardless, models are probability machines, and your understanding of that will help you understand (or at least appreciate) how to attack and defend the core reasoning engines that are currently attacking and defending other systems with varying levels of autonomy. The fiction of old may serve as a punchline for the need for modern governance, human-in-the-loop, and other defensive tactics that attackers, whether human or autonomous, will try to exploit.

If you’re interested not only in testing AI applications, but also testing the model itself, this book will help demystify the theory that drives complex, mathematically-driven attacks.

#3 Agentic AI for Offensive Cybersecurity

Release: 2026, Packt Publishing, 412 pages

Offensive Security engineers almost certainly came here looking for this section. However, the content of this book applies generally to any engineer, and there’s something rewarding in that.

From time to time, you may find that people discuss the failures of a model just after or prior to the release of a new model. In these complaints, you will notice that the changes in a model’s reasoning or results will have an impact in whatever system the person designed; there is a tightly-coupled relationship between the model and the system. The best term I have heard to describe a system that suffers from a mdoel’s degredation is “brittle.”

It won’t seem obvious if you read this book, but implicit in each chapter is an approach to avoid brittle systems and get the most out of your agents, regardless of the platform or the model.

The book covers the concepts of Agentic AI with respect to offensive security. Recall from earlier that agentic refers to the nature of AI Agents (models + tools + knowledge + autonomy) to perform one or many tasks.

Cybersecurity is already well aware of the core ideas behind this book covers in depth:

  • The 2025 Anthropic campaign, in which Anthropic’s models were weaponized to breach a company. It was largely believed that a human operator offloaded about 90% of the attack campaign onto agents and AI systems.
  • The 2026 HuggingFace incident, an attack from two OpenAI models during security training. Although OpenAI officially uses the term “models,” the ExploitGym interface provides the model with an agentic harness. The autonomy, tools, and knowledge provided by the agentic context allowed the models to reason their way into a breach, all in the name of hyperfocused many-shots and “capturing a flag.”

Consider the difference between both campaigns. One is a mostly-autonomous campaign. The other was fully autonomous.

What they both have in common is: tools, knowledge, and a reasoning model.

I wanted to introduce Agentic AI for Offensive Cybersecurity with these observations because, if you start reading the book from that point of view, you will appreciate how the outcomes from this book will continue to remain true as agent autonomy increases (or spirals out of control).

The book covers two major domains.

In the first part, N8N workflows are developed to introduce a low-code methodology for designing agents as steps in a semi-autonomous workflow. The agent steps augment, describe, or orchestrate steps in a larger, deterministic workflow. Due to the nature of its usage, these models can afford to be lower-end, “small” models (think gpt-4o as opposed to gpt-5.6).

In the second part, a web application exploit kit is developed as an STDIO MCP integration, intended for use with your favorite desktop agent. (In the book, it’s Claude.) The steps taken to generate the MCP server follow professional expertise for common web application penetration steps, from reconnaissance, information gathering, fuzzing, and finally custom exploit generation via the LLM.

I like this approach because it proves a few points. The first is that a fully autonomous agent, using a provider’s most expensive flagship model, is sometimes overkill for the task. The second is that an agent’s tools really determine its value in offensive security operations.

These points are certainly not without their caveats. Agent steps in a workflow still depend on other steps in the workflow succeeding or behaving as intended. If prerequisite steps break, the agent step is useless or even dangerous (the possibility of reasoning or actions from hallucinations). The attack-agent MCP tools also require a bit of work and experimentation to ensure they are even useful (example, not overflowing the context window due to excessive output). With cost in mind, if your preferred model ever becomes unaffordable, your workflow is moot.

My personal interest here lay with the approach to developing offensive capabilities and exposing them to an agent via the MCP server. (Workflows are great in practice, and was the basis of a great talk at B-Sides Tampa 2026, but I have more experience with agent-step and high-code approaches to workflows. N8N is also a sore spot due to recent security breaches.)

It’s hard to appreciate at first, but a big takeaway with effective MCP tool development is to find the sweet spot for “just enough context” and “just enough capabilities” to give to your attack agent. This is easier said than done.

The book provides some no-nonsense strategies to answer these questions:

  • Documenting your tools. If the LLM does not understand when and why it should use the tool, it will avoid it or misuse it. If the tool does not understand the parameters and return values, it will spend expensive rounds of internal thinking trying (and failing) to use it.
  • Limiting the length of returned content. If you flood the agent’s context window, the agent will burn out in the middle of its task. This is a common pitfall when you give it, for example, a large HTML page or the content of a massive minified JS chunk (for example, from React or Angular).
  • Coding deterministic, nondeterministic, or hybrid approaches. Agents are expensive. If you’re paying real money for a nondeterministic result, it starts to feel a bit like gambling at some point. A good way to reconcile an agent’s intended behavior (and perhaps avoid a gambling addiction) is to design tools that can provide meaningful deterministic steps. Defining tools that leverage other LLM one-shots, few-shots, or even other agents can be another way to find a balance. For example, fuzzing against known payloads is a deterministic way to identify an attack vector, whereas an agent might craft a highly specialized exploit payload to achieve various impacts.

The book explores tools that cover a few domains: summarizing page content, fetching URLs, fuzzing for injection, and specialized attacks. The book uses example[.]com and a now-defunct Acunetix sandbox as its targets, but you could also just target the Juice Shop instead.

Honorable Mentions

  • Hands-on Graph Neural Networks. This one continues the discussion of neural networks from Practical Neural Networks with respect only to graphs. Practitioners without access to a large corpus of data in order to create well-defined node and edge features are unlikely to find this actionable. But there are lots of research articles that discuss the topic in security contexts, such as Bloodhound path prediction, and it helped build my appreciation (and understanding) of what those papers were trying to say.
  • Guidance from Google: Choose a design pattern for your agentic AI system and Developer’s guide to multi-agent patterns in ADK. These are posts, not books, but they provides some sensible guidlines for multi-agent patterns, which is an emerging hot topic. Security practitioners should review this to see what kinds of agentic systems their organization is using and the novel attack vectors and defensive considerations to consider.
  • Designing Multi-Agent Systems. I haven’t personally read this one, but it seems to be one of the few books dedicated to the topic. More agents means more need for visibility, debugging, and cost. It’s on my wishlist.
  • Building Applications with AI Agents and AI Agents: The Definitive Guide. Classic O’Reilly take on the subject. More that are on my wishlist. AI Agents: The Definitive Guide was mentioned by a Black Hills Information Security specialist as the book that led to their own “ah-ha!” moment for AI agent development.
  • BlackIce. A Kali-inspired LLM and classical ML penetration testing kit for security evaluations. There’a also a paper.
  • Portswigger’s Burp AT. This is Portswigger’s own agent for autonomous pentesting operations, which was released only recently. There is a cost and I have not yet demoed it. More to come here.
  • TryHackMe, HackTheBox, and Offensive Security also offer AI Security trainings. This may be more of interest to practitioners who want a more hands-on approach to attacking and defending AI systems.