CIS 4394 Agentic AI · Fall 2026 · Dr. Xinyu Fu
CIS 4394 Agentic AI · Fall 2026 · Dr. Xinyu Fu
Four things on this page: a recap of what you should now be able to do, Group Assignment 3 (due next week, and you must join a GA3 group on iCollege before you can even see it), the Milestone II and III briefs released this week, and how the next three class sessions run: a short lecture, then project time with me walking the room. Two housekeeping notes at the end: use any tool you like, and send me your receipt if I promised to reimburse a subscription.
Assume injection succeeds. Make sure it cannot do much, and make sure you would see it if it did. Every page this week was a way of taking that sentence seriously.
| Page | The one thing to remember |
|---|---|
| 01 · How agents get attacked | Prompt injection is not breaking the model. It is writing to it: an email, a web page, a repo file, a tool result. The lethal trifecta names the three capabilities an attack needs (private data, untrusted content, a way to send things out); remove one leg and the worst case shrinks. The OWASP Agentic Top 10 gives you the vocabulary, the five stacked defenses give you the architecture, and the four 2025 cases show it already happening in products you use. |
| 02 · Governance & frameworks | The NIST AI RMF is voluntary and tells you how to organize the work: Govern, Map, Measure, Manage. The EU AI Act is binding and tells you what you owe, by risk tier. Same agent, two lenses, and you need both to answer “are we allowed to ship this, and would we know if it misbehaved?” Almost none of it is new technology: least privilege, approval workflows, segregation of duties and audit trails are controls your MIS courses already taught. |
| 03 · Practice & case | You made a real agent follow a hidden instruction on your own laptop and saw that a guard line in the prompt is a probability, not a boundary: it stopped one model and did nothing to the other. Then you attacked and patched a fictional inbox assistant on paper, where the strongest patch was a removed capability, not an added filter. Then you ran your own capstone through the six security-review questions. That checklist is the core of Milestone III. |
GA3 is due next week in your own section’s iCollege. One submission per team: the 10-case eval table with pass@1 and pass^k, the one-page security memo, your AI-use disclosure, and each member’s own peer evaluation.
The GA3 groups on iCollege are new and separate from your GA2 group. Until you join one, the assignment page and its dropbox stay invisible to you. Do it today, not the night it is due: several people wrote to me last time asking where the assignment was, and the answer was “in a group you had not joined yet.”
Team rules are the same as for GA2: 3–5 members, your own section only, one team submission plus individual peer evaluations.
GA3 is Milestones II and III rehearsed as a team. The harness and the memo carry straight into your capstone.
Both briefs are in the iCollege dropboxes of your own section, with the exact dates. If anything here differs from iCollege, iCollege wins. The short version follows, because the two are designed as a pair: II makes your agent public and measured, III makes it complete and defended.
Grading (5 pts): link opens for anyone 1 · expansion visible in it 1 · eval harness with pass^k 2 · governance note 1.
Grading (5 pts): complete system meeting all hard requirements 2 · security review 2 · limitations 1. The Implementation grade (20 pts: works live 6 · design 5 · real eval 4 · robustness 3 · craft 2) is assessed on this same submission plus your Week 14 live demo.
If you wrote your own Gradio app: app.launch(share=True).
Running on public URL: https://xxxx.gradio.live. That is your link.caffeinate -i in a second terminal. Windows: Settings → System → Power → Screen and sleep → Never when plugged in.If you see “Could not create share link”, campus Wi-Fi may be blocking it: connect the laptop to your phone’s hotspot and try again. No-code path on another platform: use its Publish or Share feature; the link must open without a login. Built it in Fleet? Fleet has no public-link option, so use the bridge in the next box. If your platform can do neither, talk to me before the deadline. The same-Wi-Fi and public-link methods are written out step by step on Week 9, page 03.
Fleet’s Sharing drawer offers Private, Workspace (marked Upgrade on the free plan) and Specific people, and all three require a LangSmith login. But every Fleet agent has an API endpoint. 11_fleet_bridge.py is a 40-line Gradio page that runs on your laptop, forwards each message to that endpoint with your key, and is shared the Week 9 way. Classmates see the page; your agent, its tools, its memory and its traces stay in Fleet. I tested it on Nov 2 with one of my own Fleet agents: two turns, memory kept across them, link opened from outside campus.
https://….us.langgraph.app) and the Agent ID. Then go to Settings → API keys and create a Personal Access Token from the same account that owns the agent. A key from any other account gets a 404.pip install gradio). Run it with the three values on the same line, so nothing is written to disk:
Open http://localhost:7862 and send a message. A reply has to come back; the page opening is not the test. Ask it something a second time to see that it remembers the first turn.
SHARE=1 in front (PowerShell: $env:SHARE="1"; before it). Copy the line Running on public URL: https://xxxx.gradio.live. Test it on your phone with Wi-Fi off. Steps 4 and 5 above apply: laptop awake, link lasts 7 days.What it costs: nothing in money. Fleet’s free plan gives each organization 5 to 7 LSUs a month (one LSU is one dollar of model work). A short turn on the Fast model costs about 5 to 7 cents, so one month’s allowance is roughly 80 to 140 turns, enough for a class session if your agent answers briefly. When it is used up Fleet pauses new runs until next month; it does not bill you. The Usage page in Fleet’s left rail shows spend per agent and lets you set a weekly limit per user: set one before class, and keep the model on Fast. The gradio.live link needs no account of any kind.
| If you see | Check |
|---|---|
| HTTP 401 | The key: it must be a Personal Access Token from the account that owns the agent. |
| HTTP 404 | The API URL and Agent ID, copied exactly from View code snippets; or the key is not the owner’s. |
| Could not create share link | Campus Wi-Fi is blocking it: connect the laptop to your phone’s hotspot and rerun. |
| Fleet paused new runs | The month’s allowance is gone (Usage page). Wait for the reset, or talk to me before the deadline. |
| Page loads, no reply | Read the error in the terminal; check the message cap notice in the chat; check Usage and the agent’s traces in LangSmith. |
From next week the class changes shape. Each session opens with Agent Radar and a short lecture, and the rest of the block is project time: you work on your capstone, I go desk to desk to unblock whatever is stuck. Bring your laptop with your project running, and come with the specific thing you cannot get past.
A short lecture on agents that buy: what changes when a run moves money, how Meta’s Muse pays, and whether stores let agents in. Then a hands-on lab: a purchasing agent on your laptop shops a teaching store while LangSmith records every step. Create a free LangSmith API key before class (steps on the Week 11 lab page). Then project time. Group Assignment 3 is due this week. No quiz.
No new lecture material. We open each other’s public links, so yours must be live in class. Submit Milestone II in your own section’s iCollege.
Milestone III and the Implementation submission are due. Last class before the Thanksgiving break; Week 14 is presentations, peer ratings and the make-up quiz.
Build the final project in whatever you like: Python with Ollama, LangGraph, any other SDK, Fleet, n8n, Copilot Studio, Opal, a hosted model on a free tier, or something I have not heard of. Every path is graded on the same standard. Two conditions, the same as all semester:
Not sure your tool qualifies? One message to me before you invest a weekend in it.