AISecurityInterviews
AI security interview preparation

Prepare for the AI security interview, from prompt injection to agentic systems.

AISecurityInterviews is interview preparation for the engineers who secure AI: LLM application security, agent and tool security, AI red teaming, model supply chain and AI governance. Worked answers, real threat models and the reasoning interviewers score.

Read the interview questions → Agentic AI security guide
  • Prompt injection
  • MCP and tool security
  • AI red teaming
  • RAG security
  • Model supply chain
  • EU AI Act and NIST AI RMF
Threat model of an LLM agent A user and a system prompt sit in the trusted zone and instruct an agent. The agent reads a web page, a third-party MCP tool server and private email, writes to a memory store and can send outbound HTTP requests. Four attack points are marked: indirect prompt injection in the web page, tool poisoning in the MCP server, exfiltration through the outbound channel and poisoning of memory. TRUSTED UNTRUSTED INPUT User Principal, sets the goal System prompt Policy and tool rules Agent LLM in a plan, act, observe loop Web page Fetched content MCP server Third-party tool specs Email and files Private data HTTP / send Outbound channel Memory store Persists across sessions 1 2 3 4
  1. 1Indirect prompt injection. Instructions hidden in content the agent reads.
  2. 2Tool poisoning. A tool description that carries instructions to the model.
  3. 3Exfiltration. A request, link or image URL that carries private data out.
  4. 4Memory poisoning. Injected text saved now and obeyed in a later session.
Private data, untrusted content and an outbound channel in one agent is the lethal trifecta. Most strong answers in an agent design round come down to removing one of the three.
What the interview covers

Eight areas, organised the way AI security work is actually split.

Each area links to worked questions. Every answer starts from a threat model and ends with the controls that address the mechanism, not a list of products.

Prompt injection and jailbreaks

  • Direct vs indirect injection
  • Why filters do not solve it
  • System prompt leakage

Agentic systems and tools

  • The lethal trifecta
  • MCP tool poisoning
  • Excessive agency and scopes

LLM application security

  • Output is untrusted input
  • RAG access control
  • Denial of wallet

AI red teaming and evaluation

  • Scoping an engagement
  • Automated attack methods
  • Measuring a guardrail

Model and data supply chain

  • Pickle and unsafe loaders
  • Poisoning and backdoors
  • Model provenance

Privacy and model attacks

  • Membership inference
  • Training data extraction
  • Model extraction via API

Threat modeling and governance

  • Threat-model an AI feature
  • OWASP, ATLAS, NIST, EU AI Act
  • AI incident response

The agent design round

A long-form guide to the question behind most agent rounds: here is an agent, now secure it.

Read the guide →
Who it is for

Built for every role that owns a piece of AI risk.

Titles vary between employers. The work underneath falls into a handful of shapes, and each one is interviewed differently.

AI security engineer

Secures LLM features and agents in production: design reviews, guardrails, tool permissions, detection and response.

Design round · secure code review

AI red teamer

Finds what breaks before users do: jailbreaks, injection chains, data leakage and harmful capability probes.

Live attack exercise · methodology

Product security engineer

Brings application security to AI features: output handling, authorization in RAG, secrets and abuse limits.

AppSec fundamentals · threat modeling

ML security researcher

Works on attacks and defences at the model level: poisoning, extraction, robustness and evaluation.

Paper discussion · research design

AI security architect

Sets the patterns teams build on: identity for agents, isolation, gateways, logging and approval flows.

Platform design · trade-offs

AI risk and governance lead

Maps AI systems to policy and regulation: NIST AI RMF, ISO/IEC 42001 and EU AI Act obligations.

Scenario judgment · frameworks

How each role is interviewed, and what to prepare →

A worked example

What a strong answer looks like.

Interviewers are not checking whether you have heard of prompt injection. They are checking whether you can reason from the mechanism to a control that still holds when the model is fooled.

Every answer on this site follows the same shape: the threat model, the mechanism, the controls in order of strength, and the scoring lines an interviewer uses to separate a pass from a strong hire.

See all worked questions →

AdvancedAgent designOWASP LLM01, LLM06

Our email assistant can read the inbox, browse the web and send mail. How do you stop a malicious web page from making it forward the user's inbox to an attacker?

Threat model

The agent holds all three legs of the lethal trifecta: private data (the inbox), untrusted content (web pages and incoming mail) and an outbound channel (send mail, plus any URL it can fetch). Any text the model reads can be read as an instruction.

Controls, strongest first

  1. Remove a leg. Once untrusted content is in context, sending is limited to recipients the user named in this session, or the session loses send entirely.
  2. Separate planning from data. A privileged planner never sees untrusted text; a quarantined model processes it and returns values the planner cannot read as instructions.
  3. Confirm at the boundary. A human approves each send with the recipient and content shown, not a summary written by the model.
  4. Close side channels. No automatic URL fetches or image rendering from model output; egress allowlists.
  5. Detect and log. Injection classifiers and anomaly alerts, treated as signals, not as the defence.
WEAK"Add a system prompt telling the model to ignore instructions in web pages." Relies on the model not being fooled.
HIRENames indirect injection, adds a classifier, scoped permissions and human confirmation for sends.
STRONG HIREIdentifies the trifecta, removes a leg by design, explains why detection is probabilistic and how the confirmation UI can itself be spoofed.
The editorial standard

Answers you can defend in front of a security team.

Threat model first

Every answer names the asset, the attacker, the entry point and the trust boundary before it names a control.

Mechanism over product

Controls are explained by what they stop and how they fail, so the answer survives a change of vendor or model.

Primary sources

Claims trace to the OWASP GenAI Security Project, MITRE ATLAS, NIST publications and the original research papers.

Dated and honest

Fast-moving facts carry the month they were checked. No invented interview loops, no "asked at company X".

Questions people ask

AI security interviews, answered briefly.

What is an AI security interview?

An AI security interview tests whether you can secure systems built on machine learning models, most often large language models and the agents built on them. Expect a threat-modeling or design round on an LLM feature or agent, questions on prompt injection and data leakage, a practical exercise such as attacking or reviewing an LLM application, and for some roles questions on model-level attacks, supply chain and AI governance.

Which topics come up most in AI security interviews?

Prompt injection (direct and indirect), agent and tool security including excessive agency and MCP servers, insecure output handling, sensitive data disclosure, access control in retrieval-augmented generation, AI red teaming methodology, model supply chain risks such as unsafe model files, and the main frameworks: the OWASP Top 10 for LLM Applications, MITRE ATLAS, the NIST AI RMF and the EU AI Act.

How do I prepare for prompt injection questions?

Learn why prompt injection exists: a model receives instructions and data in the same channel and cannot reliably tell them apart. Then practise designing systems that stay safe when the model is fooled, using privilege separation, least-privilege tools, removing outbound channels once untrusted content is present, and human confirmation for consequential actions. Treat filters and classifiers as detection, not prevention.

How is AI red teaming different from penetration testing?

A penetration test looks for exploitable flaws in deterministic software and infrastructure. AI red teaming also probes probabilistic model behaviour: jailbreaks, harmful outputs, injection chains through tools and data, and leakage of training data or system prompts. Results are measured as rates over many attempts rather than a single proof of exploit, and good engagements test the whole application, not only the model.

Do I need a machine learning background to work in AI security?

For most AI security engineering and product security roles, strong application security skills plus a working understanding of how LLMs, embeddings, retrieval and agents behave are enough. ML security research roles expect deeper knowledge: training, fine-tuning, adversarial examples, poisoning and privacy attacks such as membership inference.

Which AI security frameworks should I know for an interview?

Know the OWASP Top 10 for LLM Applications (2025 edition) for application risks, MITRE ATLAS for adversary tactics and techniques against AI systems, the NIST AI Risk Management Framework and its Generative AI Profile (NIST AI 600-1) for risk management, ISO/IEC 42001 for AI management systems, and the EU AI Act for regulatory obligations. Be ready to say which one you would use for which job.

Start with the agent design round.

Agents are where prompt injection stops being a content problem and becomes an access-control problem. The guide walks through the threat model, the design patterns that hold and how answers are scored.

Read the guide →