The Agent Attack Surface
Prompt injection, the lethal trifecta, poisoned tools, and slopsquatting — and the layered defences that keep a stranger's text from steering your agent.
New Second edition · September 2026
The Agentic Crew
Engineering in the age of AI agents
A field guide for software engineers learning to work with agents instead of against them — context, guardrails, tests, conventions, and the judgement that ties them together. Written by an engineer who ships with agents every day. Free, forever.
- 19chapters
- 2appendices
- 4languages
- €0always free
Second edition
Six months is a long time at sea.
The first edition shipped in March 2026. Since then the tools converged, cloud agents started sending pull requests, and prompt injection went from a curiosity to a string of real incidents. This edition catches up — and fixes what I got wrong.
Building Your Own Agents
From driving a coding agent to shipping your own: owning the loop and the context, humans as a tool call, durable state, and evals.
Context engineering & the new toolchain
Compaction, context rot, sub-agents, AGENTS.md, skills, hooks, cloud agents that return PRs — and a rewritten chapter on models.
The State of the Tools
The perishable details — models, prices, products — moved to one dated appendix, so the chapters can age gracefully.
Why this book
The ground is shifting.
It started with porting the Claude Agent SDK from Python to Go — using Claude Code itself. Over a hundred prompts, and one realisation: most of them were wasted, because I didn't yet know how to direct the work. Not because the model wasn't smart enough. Because I wasn't.
- i
The craft is molting, not dying
The keystrokes and boilerplate fall away. Systems thinking, taste, and judgement become the whole game.
- ii
Nobody handed us a playbook
The tools arrived faster than the practices. This is the honest engineering guide — no hype, no doom, real scar tissue.
- iii
The boring things win
Context, guardrails, tests, conventions. Tools change every quarter. Those compound over a career.
The craft isn't dying. It's molting.
The outer shell — the keystrokes, the syntax, the boilerplate — that part is falling away. But the animal underneath? The part that knows what to build and why, that smells a bad abstraction from three files away? That part is more alive than ever.
From the Foreword What's inside
The voyage, chapter by chapter.
Nineteen chapters in five parts, from what an agent really is to how whole teams work with them — plus two appendices.
I
Setting Sail
What changed, and what an agent really is
- 01
Introduction
The fundamental loop of software engineering is breaking. What it means to go from writing software to engineering it — with a crew of agents at your side.
1:46 film - 02
What Is an Agent?
Model, tools, loop, and harness. What makes something truly agentic, how tool calling actually works, how agents fail, and the right mental model for working with them.
2:36 film
II
Rigging the Ship
The durable foundations: context, guardrails, git, tests, conventions, memory
- 03
Context
The most important skill in agentic engineering is context engineering. Curating what agents see, compaction, sub-agents for isolation, and why bigger windows didn't remove the tax.
2:33 film - 04
Guardrails, Trust, and Sandboxes
The trust gradient, real permission configs, hooks the model can't talk its way around, sandboxing, and the ethics of delegation.
2:35 film - 05
Git as Agent Infrastructure
Small commits, descriptive messages, branch-per-task, worktrees for parallel agents, and reviewing at the volume agents produce.
2:30 film - 06
Testing as the Feedback Loop
Tests become the agent's eyes. TDD as a superpower, fast test suites as agent infrastructure, and the virtuous cycle of better tests and more autonomous agents.
2:45 film - 07
Convention Over Configuration
Consistent structure, AGENTS.md instruction files, and skills — conventions your agents can execute, not just read.
2:34 film - 08
The Ship's Log
Memory for agentic workflows — capturing knowledge across sessions and agents, separating knowledge from execution state, and keeping memory safe.
2:28 film
III
Beyond the Harbour
Reach, risk, intent, and the models underneath
- 09
Extending the Agent's Reach
MCP, remote servers, and connecting agents to databases, monitoring, and project management — without drowning them in tools.
2:35 film - 10
The Agent Attack SurfaceNew
Prompt injection, the lethal trifecta, poisoned tools, slopsquatting, and layered defences that limit the blast radius.
2:38 film - 11
Articulating Intent
From doing to articulating. Plan-first workflows, specs, constraints, task decomposition, voice and visual context, and skills as the modern prompt library.
2:28 film - 12
Local, Commercial, and Hybrid Models
Capability, cost, privacy, and speed. Open-weight models, subscriptions versus API spend, honest ROI, and matching the model to the task.
2:38 film
IV
Running a Fleet
Many agents, pipelines, and building your own
- 13
Multi-Agent Orchestration
Sub-agents for context isolation, background agents that return PRs, the handover pattern, and knowing when more agents isn't better.
2:37 film - 14
Agents in the Pipeline
Agents in CI/CD — review bots, the overnight agent turned product, cost control, and untrusted input when nobody's watching.
2:26 film - 15
Building Your Own AgentsNew
From driving a coding agent to shipping your own — owning the loop, the context, human approvals, durable state, and evals.
2:38 film
V
Hard-Won Lessons
Failure, restraint, teams, and what lasts
- 16
When Agents Get It Wrong
War stories from the field — the eager refactorer, the hallucinated library, the poisoned ticket — plus a diagnostic playbook for fixing agent failures.
2:39 film - 17
When Not to Use Agents
The overhead tax, architecture decisions, security-critical code, hostile input, legacy codebases, and the craft argument.
2:30 film - 18
Agentic Teams
Measured versus perceived productivity, code review at volume, a path for junior engineers, knowledge distribution, compliance, and hiring.
2:52 film - 19
Final Words
The craft isn't dying — it's shedding its skin. What changed my mind since the first edition, and why the captain still matters.
2:31 film
Tech-savvy but don't write code? The same ideas, translated for designers, PMs, founders and everyone else on the crew. About the Crew Member's Guide →
- 01
Welcome to the Crew
The horizon is wider than you think. Why this book exists — and why it's for you.
- 02
The Ground Is Shifting
The line between technical and non-technical is dissolving. What's changing, and why it matters for your role.
- 03
What's Under the Hood
Every app is a restaurant — front of house, kitchen, and pantry. A plain-language tour of how software actually works.
- 04
What Is an Agent, Really?
Observe, plan, act, check — repeat. The mental model that makes everything else click.
- 05
How to Give Good Instructions
The two-captains story that changes how you think about prompts — and why you should ask for a plan first.
- 06
Context In, Verification Out
An agent can only work with what's on the bench. Setting up the right inputs, keeping the bench tidy, and checking the output.
- 07
The Trust Gradient
Start tight. Loosen with evidence. How much autonomy to give, and when to pull the reins.
- 08
Extending the Crew's Reach
Connecting the agent to the world beyond its window — connectors, tools, and integrations.
- 09
Hidden InstructionsNew
When the email gives your agent orders. Prompt injection, the lethal trifecta, and the three-question check before you connect anything.
- 10
Building Something Real
From idea to working prototype in a weekend. Your first hands-on walkthrough.
- 11
The Padlock
The sealed envelope — how the internet keeps secrets. Security explained without jargon.
- 12
Building Something Without Code
The principles transfer to everything. A second walkthrough that proves you don't need to be a programmer.
- 13
When Things Go Wrong
The mistakes are inevitable. The recovery is a skill. Real war stories and how to handle them.
- 14
When to Do It Yourself
Sometimes the right tool is your own hands. Knowing when agents aren't the answer — and when it only feels faster.
- 15
Being the Human in the Loop
You are the quality control. Reviewing work that agents did while you were away — and why your attention is the new bottleneck.
- 16
Talking to Your Tech Team
You speak two languages now. How to bridge the gap between technical and non-technical colleagues.
- 17
Keeping Your Finger on the Pulse
Ten minutes, three times a week. How to stay current without drowning in the firehose.
- 18
Getting Started: Your First Agent
Which tool do you actually open on Monday morning? The state of the tools, September 2026.
- 19
Final Words
Now go build something. You were always technical enough.
The captain
Rasmus Bornhøft Schlünsen
Fifteen-plus years in the software industry — from Django database backends and embedded systems to Rust CLI tools and open-source libraries used by thousands, including django-timescaledb and rana. He works as an AI R&D Engineer at Clovrlabs.
He knows what a production incident feels like at 2am and what it takes to ship real products. These days he spends most of his time building agentic systems — and writing down the playbook he wished he'd had.
Free download
Take it aboard.
No sign-up, no email wall. PDF for reading at a desk, EPUB for e-readers. Download it as often as you like.
The Agentic Crew — second edition, September 2026
PDF Print layout Desktop and tablet. Full typesetting. EPUB E-reader Reflowable for Kindle, Kobo, iPad.
Prefer slides? Try the interactive presentation. Past versions live in the revision archive.
More from the series
Crew Member's Guide
The same ideas for people who don't write code. English and Català.
Hands-On Guide
Exercises for your own machine: fork, build, ship, and pentest with an agent.
This project is free and always will be.
☕ Buy me a coffee Listen free
Hear it on watch.
AI-narrated audiobooks, chapter by chapter: both books, two voices, English and Catalan. It remembers where you stopped.
01
0:00 8:17
17 chapters · about 4 h 37 min · Narrates the first edition; the second-edition chapters are on the way. Download the whole book (MP3, 147 MB)
21 chapters · about 2 h 41 min Download the whole book (MP3, 76 MB)
21 chapters · about 2 h 36 min Download the whole book (MP3, 82 MB)
19 chapters · about 2 h 41 min Download the whole book (MP3, 88 MB)
