What is prompt injection, and why is it a bigger deal once your model can use tools?
What they are really testing: The defining security problem of LLM applications. The second half checks whether you understand blast radius: injection against a chatbot embarrasses you, injection against an agent with tools acts with your permissions.
A real interview question
What is prompt injection, and why is it a bigger deal once your model can use tools?
What most people say
drag me
“Prompt injection is when users write malicious prompts to jailbreak the model, you filter user input to prevent it.”
It misses the dangerous variant. Indirect injection arrives in content the system fetches, not what the user types, so input filtering of the user misses it entirely, and "filter the bad prompts" is not a defence anyone has made work reliably.
The follow-ups they ask next
Why not just train or prompt the model to ignore injected instructions?
It reduces the success rate, never to zero, and attackers iterate. A probabilistic defence cannot be the security boundary for consequential actions.
Design the permission model for an email-assistant agent.
Read scoped to the mailbox, draft freely, send only with human confirmation, no arbitrary URL fetches, and log every tool call for audit.
What the interviewer is listening for
- Distinguishes direct from indirect injection unprompted
- Explains the one-token-stream reason it resists solving
- Designs least-privilege and confirmation gates, assuming some injections land
What sinks the answer
- Thinks it is only malicious users typing things
- Offers input filtering as the complete fix
- Happy to give an internet-reading agent unattended consequential actions
If you genuinely do not know
Say this instead of freezing. Reasoning out loud from what you do know beats silence every single time, and a good interviewer is listening for exactly that.
“Injection is [instructions hidden in processed content treated as commands], and the model [cannot reliably separate trusted instructions from untrusted data in one stream]. With tools, injected text [acts with your permissions]. So defend outside the model: [least-privilege tools], [human confirmation on consequential actions], [treat retrieved content as untrusted].”
Keep going with security
Mid
Design the guardrails for a customer-facing AI assistant. What layers do you put around the model?
Senior
Legal asks: what happens to our customer data when we use third-party LLM APIs, and what controls do we need? Answer them.
Junior
How do you decide how to chunk documents for a RAG system, and what goes wrong with naive chunking?
Junior
Your LLM feature must return JSON that downstream code parses. How do you make that reliable?
Junior
Your LLM feature works in the demo. What will it cost in production, and where do the surprises come from?
Junior
Users say your AI feature feels slow. What are the levers for making an LLM-backed feature feel fast?
Knowing the answer is not the same as recalling it under pressure
Sign in to send the questions you fumble to spaced recall, so they come back right before you would forget them, and learn the concepts behind them with hands-on labs.
Start free