Skip to content
AI Security
AI security interview preparation

Understand the attack.
Defend the design.

Learn the security behind AI systems, from identity and cloud to prompt injection and agents. Visual explanations, worked answers and hands-on reasoning for your next interview.

Start reading, free Find a path for me

187 free reads. No account needed to begin.

Interactive design review01 / AGENT SECURITY

An agent reads a hostile document.

What stops it from exposing customer data?

User requestTrusted taskExternal documentUntrusted instructions
AI agentReads context · proposes tool calls
Enforcement outside the model
Customer recordsUser permissions checked
Outbound requestsDestinations restricted

A narrower blast radius. The model may still follow the document. Tool permissions limit which data it can read and where it can send it.

Study the mechanism
A good place to get curious

One idea. A different way to see the system.

Open a full lesson, follow the diagrams, and test your understanding. These reads are free from start to finish.

FIELD NOTES / 01Free lesson

Trust Boundaries, Assets and Adversaries

Security reasoning starts with three questions: what is worth protecting, who could want it and with what ability, and where data or control crosses from one level of trust to another. A trust boundary marks a change in authority or trust. Reviewing the checks at those crossings helps explain failures such as SQL injection and prompt injection.

Read the lesson
FIELD NOTES / 02Free lesson

What Is Prompt Injection?

Prompt injection attempts to turn lower-authority content into instructions that override a task or governing rules. Learn to separate legitimate requests, source influence, model proposals, application enforcement and observed effects, with a worked support scenario and scoped control claims.

Read the lesson
FIELD NOTES / 03Free lesson

The Lethal Trifecta

The lethal trifecta, a term coined by Simon Willison in 2025, is the combination of three capabilities in one AI agent: access to private data, exposure to untrusted content, and the ability to communicate externally. With all three, an instruction hidden in untrusted content can make the agent read private data and send it out. Use the combination to trace a possible disclosure path, then remove unnecessary capabilities or enforce restrictions outside the model. A narrower token alone does not revoke an older, broader token.

Read the lesson
The standard for a useful answer

Go beyond naming the vulnerability.

Take prompt injection. A definition gets you started. A useful answer explains the trust boundary, chooses a control and names what that control still cannot prevent.

  1. 01
    Explain the failure

    Identify who controls the input and what authority it reaches.

  2. 02
    Defend a design decision

    Choose an enforceable control and describe its limits.

  3. 03
    Handle the follow-up

    Change one constraint. Work out whether your answer still holds.

Open the worked question, free →
easyPrompt Injection & Jailbreaks

What is prompt injection, and how is it like and unlike SQL injection?

The central idea

Both involve untrusted input being treated as instructions. Parameter binding keeps values from changing a fixed SQL statement's syntax; prompt labels guide model behavior, while application services must independently enforce access, audience and action rules.

Weak
Calls either problem universally solved or impossible, and relies on formatting, filtering or a stronger prompt as the permission rule.
Hire
Explains scoped parameter binding, source authority and model behavior, then puts the relevant read or effect check in an independently enforced service.
Strong hire
Separates permitted processing from disclosure, tests valid work and observation gaps, and explains the trusted inputs and coverage of the proposed control.
Where are you starting from?

A useful next step, wherever you start.

Choose the experience you bring. Follow a short sequence with the access requirements shown before you open a lesson.

Your first three lessons

Your route into AI security

Trace where input becomes authority. Start with trust boundaries and injection, then apply the same reasoning to LLM features.

  1. 01Trust Boundaries, Assets and AdversariesThe habit every later lesson relies on.Free
  2. 02Threat Modeling with Data-Flow Diagrams and STRIDEA repeatable way to find what can go wrong.Free
  3. 03Injection VulnerabilitiesSQL injection to SSRF: the shape prompt injection repeats.Free
Open the first lesson All 7 lessons in this route →
The curriculum

From trust boundaries to AI design reviews.

Explore the curriculum by area. Each topic connects explanations to worked questions, so you can study a mechanism and then reason through a decision.

01Security foundationsTrust boundaries, identity, networks, applications and the systems underneath.10 topics
379 questions
Security Foundations & Threat Modeling6 lessons · 30 questionsSystems, OS & Memory Safety9 lessons · 53 questionsNetwork Security & Protocols8 lessons · 38 questionsCryptography, PKI & TLS7 lessons · 38 questionsIdentity, OAuth & Access Control12 lessons · 36 questionsApplication & API Security11 lessons · 49 questionsMobile Application Security6 lessons · 31 questionsCloud, Container & AI Infrastructure Security13 lessons · 38 questionsSoftware, Data & Model Supply Chain10 lessons · 29 questionsDetection Engineering & Incident Response15 lessons · 37 questions
02How AI systems work and failModel context, data sources and prompt injection.2 topics
55 questions
How LLM Systems Work8 lessons · 25 questionsPrompt Injection & Jailbreaks9 lessons · 30 questions
03Securing AI applicationsApplications, retrieval, agents, tools and MCP.2 topics
80 questions
LLM Application Security6 lessons · 33 questionsAgent, Tool & MCP Security9 lessons · 47 questions
04Models, testing and governanceAttacks on the model, red teaming and response, and the rules.3 topics
100 questions
Adversarial ML & Model Privacy6 lessons · 31 questionsAI Red Teaming, Evaluation & Response5 lessons · 31 questionsAI Governance, Risk & Compliance7 lessons · 38 questions
Explore all 147 concept lessons →

THE SECURITY FIELD GUIDES

One subject. A book you can keep.

Build a connected understanding, then return to the linked lessons and interview questions to practise.

Browse the guides

FIELD GUIDE 01 · PREMIUM

Machine Learning Model Security

Trace model risk from dataset intake to inference. Learn poisoning defenses, privacy accounting, artifact admission and evidence-based release decisions.

43 pages · 12 diagrams
Look inside

FIELD GUIDE 02 · PREMIUM

LLM & Agent Security

Design agents that can read untrusted material without inheriting its authority. Connect retrieval, delegated identity, tool policy, memory and approvals into a defensible system.

47 pages · 15 diagrams
Look inside

FIELD GUIDE 03 · PREMIUM

DNS Security & Domain Integrity

Understand DNS from wire semantics to domain ownership. Build reliable validation, encrypted resolution, protective policy and incident response without confusing authenticity with safety.

48 pages · 15 diagrams
Look inside

FIELD GUIDE 04 · PREMIUM

Enterprise Network & Zero Trust

Design defensible access across campuses, cloud networks and AI infrastructure. Learn packet behavior, identity-aware enforcement, segmentation, inspection, resilience and migration trade-offs.

53 pages · 17 diagrams
Look inside
Choose the access you need

Study the free material. Go deeper when you need to.

Start with full lessons and worked answers. Premium adds the rest of the library and the complete practice bank, with six months to work through it at your pace.

Free

  • 5 worked answers per topic, 10 with a free account
  • The first lessons of every course and curriculum track
  • The glossary, career guides and every blog article
  • Readiness assessment and bookmarks

Premium · $25

  • Every worked answer in all 17 topics
  • Every lesson of every course, every concept page
  • The full practice-test bank at every difficulty
  • Anything published while your access runs

6 months · One payment · No auto-renewal

See Premium
Company guides

Prepare for the role you want.

Company guides bring together team focus, sourced pay ranges and interview information. Public evidence varies; each guide shows its sources and limits.

AnthropicOpenAIGoogle DeepMindMicrosoftPalo Alto NetworksCrowdStrike
Independent preparation. No company affiliation or endorsement.Explore all 34 company guides →
Questions people ask

Before you start.

What is AI security?

AI security is the practice of protecting systems that use machine learning models, most often large language models and the agents built on them, from attacks that steal data, take unauthorised actions, corrupt the model or abuse it. It combines classic security engineering (threat modeling, identity, application and cloud security) with risks that are new to AI: prompt injection, agents with too much authority, poisoned training data, unsafe model files and attacks that extract what a model learned.

Do I need a security background to start?

No. The curriculum starts with security foundations (assets, adversaries and trust boundaries, threat modeling, cryptography and identity) and builds up to AI-specific topics in the order they depend on each other. Engineers who already work in security can start at the stage on how LLM systems work and skip ahead.

What do AI security interviews ask about?

The emphasis varies by role. This bank covers threat modeling for LLM features, prompt injection, agent permissions, output handling, data leakage, evaluation, model supply chain and governance, alongside security foundations. Use the company guides for sourced interview information and its limitations; these practice questions are not attributed to particular employers.

What is free, and what does Premium add?

Every topic opens with worked answers anyone can read (5 per topic without an account, 10 with a free one), the first lessons of every course and every curriculum track are free, and the glossary, career guides and blog are free. Paid Premium also includes downloadable PDF field guides and unlocks every answer, lesson, concept and practice test for six months with one payment and no auto-renewal.

Is the content about attacking real systems?

It teaches how attacks work so you can defend against them and explain them in an interview. It never publishes working exploit payloads or instructions to harm real systems. Every attack is paired with the controls that stop it and the reasoning behind them.

Make the first lesson count

Start by drawing a trust boundary.

Name the asset, the adversary and the crossing. Use that habit in every design that follows.

Read the first lesson