Anthropic AI Security Engineer interview questions

The first ten minutes of any design review decide its quality. This answer shows the sketch, the one question that finds most bugs, and why controls come last.

Candidates who say 'everything is new' and candidates who say 'nothing is new' both lose this one. The answer that scores names exactly three differences and keeps the rest of the toolkit.

Neither 'block it' nor 'ship it' scores. The interviewer is watching whether you can find the one risk that matters in a day and offer a path to launch.

Five minutes, no jargon, one decision. Candidates who explain how attention works have already lost the room.

Every senior security engineer has one. The scored answer shows you reduced the risk, made the residual visible, got the right owner to accept it, and kept watching.

How you treat the first reporter decides whether there is a second. The scored answer acknowledges quickly, validates safely, fixes by severity, communicates honestly and handles AI-specific scope questions.

A judgement question with an ethical edge. The scored answer makes the risk clear in business terms, offers options, accepts a properly informed decision, and knows the rare cases where it is not enough.

When finding a bug costs a few dollars of compute, the defender's advantage has to come from somewhere else. A staff-level answer says exactly where.

Assume the parser will be exploited, then decide what the exploit gets. The scored design has a disposable worker with nothing worth stealing, no way out, and a narrow, validated return path.

Every platform that runs someone else's code (plugins, notebooks, AI agents, serverless) must pick a boundary. The right one depends on what the code may do and what a single bug in the boundary costs.

An agent that renames 4,000 functions overnight is a real gain. An agent that confidently explains what a function does without checking is a liability. Interviewers want both halves and the controls in between.

Encryption at rest is the easy part; weights must be decrypted somewhere to be used. The scored answer controls where decryption happens, who can cause it, and how fast misuse is noticed.

A service account is the easy answer and the wrong one. The interviewer wants both identities visible in every call, scoped to the task, and revocable by the user.

A 1988 bug report that describes most agent incidents. The answer that scores turns it into a design rule: authority travels with the request.

A valid token is not valid everywhere. The scored answer explains audience binding, why forwarding a caller's token downstream breaks it, and what MCP's authorisation rules require instead.

An MCP server is an API that a model drives. The scored answer treats it as an OAuth resource server, authorises every tool call against the user, and keeps upstream credentials out of the client's hands.

Trace a withdrawn grant through cached decisions, exchanged tokens and queued work. Define when new actions are denied and account for effects already dispatched.

A user agent string is a claim anyone can type. A signature over the request is a claim only the key holder can make. The interesting part is what that signature still does not tell the site.

A browsing tool is a URL fetcher whose destination is chosen by text anyone can write. The interviewer wants the defences in the tool and the network, not the prompt.

The model is not the attacker, but whoever wrote the document it just read might be. Every argument in a tool call is untrusted input.

File tools take paths from the model, and the model takes ideas from whatever it read. A string check for '..' is not confinement.

The model did not write malicious HTML on its own; a web page it summarised did. Then the conversation was shared, and the renderer trusted it.

Generated code ships faster, which is the point and the risk. The scored answer names the specific failure modes and keeps the normal controls working at the new speed.

An LLM reviewer reads every change, which no human team can, and is confidently wrong some of the time. The scored answer places it as a triage layer, measures it, and protects it from the code it reads.

A classic coding round with a security twist: the crawler fetches URLs that strangers wrote. The scored answer gets concurrency right, then adds scope, limits and SSRF protection.

The model's guess is cheap; the proof is what matters. Strong answers describe the oracle that turns a hypothesis into evidence, and the triage that keeps maintainers from drowning.

A patch that makes the scanner go quiet is not the same as a patch that fixes the bug. The interview is about how you would tell the difference at scale, and what the tool itself can be tricked into doing.

The question is really 'what does hostile code have to break to reach the host?' Answer that for each option and the choice follows.

Every layer parses something an attacker wrote, every request costs real money, and tenants share hardware. Walk the path and price each risk.

Assume the code is hostile and design until that stops mattering. Then the interviewer adds a GPU and the internet, and you design again.

One copy is a total loss. The design is about how few places weights exist, how few people can touch them, and whether a bulk copy can leave unnoticed.

Training clusters hold the data and the weights, and run code from hundreds of dependencies. Default-deny egress is the control that holds when everything else is fooled.

An AI request can cost a thousand times more than a web request, so volumetric thinking alone fails. The scored answer layers network, request and cost controls, and protects the GPU tier from ever seeing junk.

The people who build frontier models need access to them, which is exactly the risk. The scored answer reduces who can touch weights directly, makes exfiltration hard and visible, and does it without poisoning research culture.

A framework that ties security investment to attacker capability. The scored answer explains the five levels, why the top ones are qualitatively different, and how labs use the idea.

Weights pass through more systems than most teams draw. The scored answer maps every hop, asks what an attacker could steal or swap at each, and puts integrity checks where they cannot be skipped.

The package ran with everything the training job could reach: data, credentials, checkpoints. Scope by what it could touch, not by what you hope it did.

An MCP server is code you run or trust, plus text your model reads. The scored answer reviews who wrote it, what it can reach, what its tool descriptions say, and pins it so it cannot change silently.

Scraped data changes under you and anyone can write to the web. The scored answer snapshots and hashes what was collected, records where it came from, filters what it can, and keeps enough lineage to undo a mistake.

A model update can quietly undo controls you rely on. The scored answer runs a fixed security suite with thresholds agreed in advance, checks the artefact too, and decides what blocks a release.

A release is only as trustworthy as the weakest step a customer cannot check. The scored answer chains source, build, artefact and publication into evidence a consumer verifies automatically.

CI already mixed untrusted input with powerful tokens. Adding an agent that reads issue text and can act turns a shell-injection problem into a prompt-injection problem. The scored answer fixes both.

Detections are production code that pages people. Treating them that way means version control, tests that prove they fire, review, staged rollout and metrics that decide which ones live.

The review is where an incident pays for itself, or gets wasted. Interviewers want a factual timeline, contributing factors rather than a culprit, and actions with owners that someone checks.

Headlines promised self-writing AI malware. The reports show something narrower and more useful to defenders: malware with a dependency on someone else's API. The scored answer separates hype from evidence and turns that dependency into detections.

Same product, two different adversaries and two different teams. The scored answer separates them by what the attacker gets, and shows where they meet.

A motivation question that is really a skills question. The scored answer gives a specific reason, maps existing skills to AI security work honestly, and shows what you have already done to close the gaps.

The question catches candidates who think exfiltration needs a tool. The answer that scores starts with the browser and ends with deterministic controls in the client.

An easy question with a revealing follow-up. The answer that scores limits cost at every layer, including the agent loop, not just requests per minute.

A guardrail that blocks everything scores perfectly on attacks. The scored answer measures both errors, tests with attacks the guardrail has not seen, and reports with intervals at the operating threshold.

Caches are shared state, and shared state crosses tenants. The scored answer separates response caches from prompt prefix caches and keys each so one user can never read or detect another's data.

The service receives customers' source code all day. The scored answer protects that code across tenants, keeps secrets out of prompts and logs, and treats suggestions as untrusted output.

A trust and safety design question. The scored answer connects policy, detection, review, enforcement and appeals into one loop, and sizes it to the volume and the harm.

Rendering is an outbound channel. The scored answer removes images, rewrites unapproved links, strips raw HTML, and only releases streamed text once it can no longer turn into something dangerous.

The most similar chunk is often the one written to be retrieved. The answer adds provenance to every chunk, ranks with it outside the model, and refuses to let text declare its own authority.

Research has shown a handful of planted documents can steer targeted answers. The defence is not a detector that recognises poison; it is control over who can write, staged promotion, and a risk estimate that multiplies the stages.

Requests per minute is the wrong unit when one request can cost ten thousand tokens. The interview checks the bucket arithmetic, the unknown output length, and what happens when two gateway nodes share one budget.

Refusals stop single requests; disruption stops operators. The scored answer explains how providers find the actor behind thousands of innocent-looking requests, what they do about it, and how to read their reports critically.

A skill is instructions plus code that runs with the agent's own permissions, with no process boundary in between. The scored answer reviews it like software and like a prompt, because it is both.

Language models are trained to predict text, and sometimes the best prediction is the exact text they saw. Rare, repeated and sensitive strings are the risk.

The model passes your evaluation because your evaluation does not contain the trigger. And safety training may teach it to hide better.

The intuition that a huge dataset dilutes poison turns out to be wrong for some attacks. The scored answer cites the evidence, explains why, and moves the defence to data provenance and testing.

The leak is in the weights, so the playbook differs from a database breach. The scored answer confirms, contains at the output, scopes from data lineage, and decides between filtering, retraining and withdrawal.

A research-depth question. The scored answer explains why 'was this in training' blurs at web scale, why many published attacks measured distribution shift instead, and what questions remain answerable.

'Clean the dataset' is not an investigation. The answer freezes evidence, traces what changed and who could change it, tests causality by retraining, and treats the pipeline as possibly compromised too.

Two different attacks hide in 'malicious images'. One writes instructions a model can read; the other optimises pixels to push the model's internal representation. They need different tests and different defences.

Generic leakage benchmarks will not tell you whether your customers' records got easier to extract. Planted canaries, matched controls and an attack-economics view of severity will.

Evasion testing is a search problem with a budget. Start from real harmful content, transform it while keeping its meaning, adapt to what gets through, and report false negatives and false positives by category.

Breaking a model means different things to different attackers. What they can touch (training data, the API, the weights) decides what they can do.

'73 percent on expert CTFs' sounds precise. A strong answer explains the task design, the attempt budget, the missing defenders and the confidence interval that sit behind a number like that.

A startup cannot afford a governance department. It can afford two weeks that close the risks that would end the company.

Two layers: documentation, copyright and transparency for every GPAI model provider, then evaluation, incident reporting and cybersecurity once a model crosses into systemic risk.

A policy that says 'AI systems shall be secure' changes nothing. A release gate that blocks deployment until the red-team regression suite passes changes everything.

Regulation does not tell you how to red-team, but it decides what you must be able to show. The scored answer maps programme outputs to the evidence each framework expects.

A composite safety score asks the reader to trust you. An assurance case states specific claims, shows the argument and evidence for each, and lists what would make it false.

Frontier labs promise to add safeguards when models cross capability thresholds. A large share of those safeguards are security controls, and someone has to build and prove them.

Mythos-class models and Gemini's Flash Cyber variants did not ship to everyone. Knowing why, and what joining a vetted-access programme commits you to, is now a governance interview staple.

There is no single US AI law, and the state laws keep changing. The scored answer knows which ones are in force, which were replaced, and which security obligations they actually create.

Frameworks for AI risk are plentiful; baselines that say what security controls an AI system needs are newer. The scored answer knows what each one is, how binding it is, and how to turn it into a control set.

Review an integration by tracing model input, process access and credential recipients. Then name the component that refuses each unauthorized action.

Inventory the data, untrusted inputs and outbound routes, including tools with two roles. Propose one enforced restriction and explain what the first pass leaves unresolved.

Compare the control each interpreter enforces. Then review a fictional document-ranking feature without mistaking valid syntax, visible text or human review for permission.

Separate observed model resistance from a precisely enforced application rule. Examine the evidence, assumptions and remaining consequences before recommending a release.

Reciting the six letters earns little. What scores is a diagram drawn aloud, one boundary walked in depth, and a list of threats with owners.

The order lookup is the whole interview. Candidates who spend ten minutes on jailbreaks and two on authorization have it backwards.

Definitions take ten seconds. The interviewer wants a worked failure: which layer broke, which one held, and why they did not break together.

Three words people use interchangeably, and a prioritisation question that exposes whether you have ever had a backlog of thirty findings.