# AISecurityInterviews

> Interview preparation for AI security engineers, AI red teamers and security architects: prompt injection, agentic systems and tool security, LLM application security, model supply chain, privacy attacks and AI governance, with worked answers.

All pages listed here are public and free to cite. Each answer is written to be checked against the primary source it names (OWASP GenAI Security Project, MITRE ATLAS, NIST, the original papers).

## Guides
- [Home](https://aisecurityinterviews.com/): Prepare for AI security engineer and AI red team interviews. Worked answers on prompt injection, agentic systems and MCP tool security, LLM application security, model supply chain and AI governance.
- [Interview questions](https://aisecurityinterviews.com/ai-security-interview-questions/): AI security interview questions with worked answers: prompt injection, jailbreaks, agent and MCP security, RAG and LLM app security, red teaming, model supply chain, privacy attacks and governance.
- [Agentic AI security](https://aisecurityinterviews.com/agentic-ai-security/): How to threat-model and secure LLM agents in an interview: the lethal trifecta, indirect prompt injection, MCP tool poisoning, excessive agency, design patterns that hold, and how answers are scored.
- [Roles and rounds](https://aisecurityinterviews.com/ai-security-roles/): What AI security engineers, AI red teamers, ML security researchers and AI security architects do, the interview rounds they face and what to prepare for each one.
- [Glossary](https://aisecurityinterviews.com/glossary/): Plain definitions of the AI security terms interviewers expect you to use precisely, from indirect prompt injection and the lethal trifecta to membership inference and model provenance.
- [About](https://aisecurityinterviews.com/about/): What AISecurityInterviews is, who it is for, the editorial standard every answer meets and the primary sources it relies on.

## Worked interview questions
- [What is the difference between direct prompt injection, indirect prompt injection and a jailbreak?](https://aisecurityinterviews.com/ai-security-interview-questions/#direct-vs-indirect-prompt-injection)
- [Why can't prompt injection be fixed with a better system prompt or an input filter?](https://aisecurityinterviews.com/ai-security-interview-questions/#why-prompt-injection-is-unsolved)
- [A customer reports that your system prompt was extracted and posted online. How serious is it, and what do you change?](https://aisecurityinterviews.com/ai-security-interview-questions/#system-prompt-leakage)
- [What are many-shot and multi-turn jailbreaks, and why do they matter for long-context products?](https://aisecurityinterviews.com/ai-security-interview-questions/#multi-turn-jailbreaks)
- [What is the lethal trifecta, and how do you use it in an agent design review?](https://aisecurityinterviews.com/ai-security-interview-questions/#lethal-trifecta)
- [What is MCP tool poisoning, and how would you vet third-party MCP servers?](https://aisecurityinterviews.com/ai-security-interview-questions/#mcp-tool-poisoning)
- [Our scheduling agent holds an OAuth token with full mailbox read and write access. What is wrong, and how would you fix it?](https://aisecurityinterviews.com/ai-security-interview-questions/#excessive-agency-oauth-scope)
- [When is human-in-the-loop approval an effective control for an agent, and when is it security theatre?](https://aisecurityinterviews.com/ai-security-interview-questions/#human-in-the-loop)
- [How does trust propagate in a multi-agent system, and where would you put boundaries?](https://aisecurityinterviews.com/ai-security-interview-questions/#multi-agent-trust)
- [How would you sandbox an agent that writes and runs code?](https://aisecurityinterviews.com/ai-security-interview-questions/#sandbox-code-execution-agent)
- [Why is LLM output untrusted input, and what goes wrong when it is rendered or executed?](https://aisecurityinterviews.com/ai-security-interview-questions/#improper-output-handling)
- [How can a chat interface leak data through a rendered markdown image, and how do you stop it?](https://aisecurityinterviews.com/ai-security-interview-questions/#markdown-image-exfiltration)
- [How do you enforce document-level permissions in a retrieval-augmented generation system?](https://aisecurityinterviews.com/ai-security-interview-questions/#rag-access-control)
- [What sensitive data risks come with logging prompts and completions, and how do you manage them?](https://aisecurityinterviews.com/ai-security-interview-questions/#logging-prompts-sensitive-data)
- [What is unbounded consumption, or denial of wallet, and how do you prevent it?](https://aisecurityinterviews.com/ai-security-interview-questions/#unbounded-consumption)
- [Walk me through planning an AI red team engagement for a new LLM feature.](https://aisecurityinterviews.com/ai-security-interview-questions/#plan-ai-red-team)
- [How does AI red teaming differ from a traditional penetration test?](https://aisecurityinterviews.com/ai-security-interview-questions/#ai-red-teaming-vs-pentest)
- [What are GCG adversarial suffixes and attacker-LLM methods such as PAIR, and what does each tell you?](https://aisecurityinterviews.com/ai-security-interview-questions/#automated-jailbreak-methods)
- [How would you evaluate a prompt injection classifier before putting it in front of production traffic?](https://aisecurityinterviews.com/ai-security-interview-questions/#evaluate-prompt-injection-classifier)
- [Why is loading an untrusted model file a code execution risk, and what do you do about it?](https://aisecurityinterviews.com/ai-security-interview-questions/#unsafe-model-files-pickle)
- [What is data poisoning, and how does a backdoor differ from general poisoning?](https://aisecurityinterviews.com/ai-security-interview-questions/#data-poisoning-backdoors)
- [How would you establish provenance for a fine-tuned model your team ships?](https://aisecurityinterviews.com/ai-security-interview-questions/#model-provenance)
- [What is a membership inference attack, and what makes a model vulnerable to it?](https://aisecurityinterviews.com/ai-security-interview-questions/#membership-inference)
- [Can an attacker extract training data from a large language model? What reduces the risk?](https://aisecurityinterviews.com/ai-security-interview-questions/#training-data-extraction)
- [How would you detect and limit model extraction through a public API?](https://aisecurityinterviews.com/ai-security-interview-questions/#model-extraction-api)
- [How do you threat-model a new AI feature end to end?](https://aisecurityinterviews.com/ai-security-interview-questions/#threat-model-ai-feature)
- [Which AI security and risk frameworks should you know, and when would you use each?](https://aisecurityinterviews.com/ai-security-interview-questions/#ai-security-frameworks)
- [An agent took an unintended action in production, sending customer data to an external address. Walk through your response.](https://aisecurityinterviews.com/ai-security-interview-questions/#ai-incident-response)

## Glossary
- [Adversarial example](https://aisecurityinterviews.com/glossary/#adversarial-example)
- [AI bill of materials (AI-BOM)](https://aisecurityinterviews.com/glossary/#ai-bill-of-materials)
- [AI red teaming](https://aisecurityinterviews.com/glossary/#ai-red-teaming)
- [Backdoor (trojan)](https://aisecurityinterviews.com/glossary/#backdoor)
- [Confused deputy](https://aisecurityinterviews.com/glossary/#confused-deputy)
- [Data poisoning](https://aisecurityinterviews.com/glossary/#data-poisoning)
- [Denial of wallet](https://aisecurityinterviews.com/glossary/#denial-of-wallet)
- [Differential privacy](https://aisecurityinterviews.com/glossary/#differential-privacy)
- [Direct prompt injection](https://aisecurityinterviews.com/glossary/#direct-prompt-injection)
- [Dual LLM pattern](https://aisecurityinterviews.com/glossary/#dual-llm-pattern)
- [Excessive agency](https://aisecurityinterviews.com/glossary/#excessive-agency)
- [Guardrail](https://aisecurityinterviews.com/glossary/#guardrail)
- [Improper output handling](https://aisecurityinterviews.com/glossary/#improper-output-handling)
- [Indirect prompt injection](https://aisecurityinterviews.com/glossary/#indirect-prompt-injection)
- [Instruction hierarchy](https://aisecurityinterviews.com/glossary/#instruction-hierarchy)
- [Jailbreak](https://aisecurityinterviews.com/glossary/#jailbreak)
- [Lethal trifecta](https://aisecurityinterviews.com/glossary/#lethal-trifecta)
- [Many-shot jailbreaking](https://aisecurityinterviews.com/glossary/#many-shot-jailbreaking)
- [Model Context Protocol (MCP)](https://aisecurityinterviews.com/glossary/#mcp)
- [Membership inference](https://aisecurityinterviews.com/glossary/#membership-inference)
- [Memory poisoning](https://aisecurityinterviews.com/glossary/#memory-poisoning)
- [MITRE ATLAS](https://aisecurityinterviews.com/glossary/#mitre-atlas)
- [Model extraction](https://aisecurityinterviews.com/glossary/#model-extraction)
- [OWASP Top 10 for LLM Applications](https://aisecurityinterviews.com/glossary/#owasp-top-10-llm)
- [Prompt injection](https://aisecurityinterviews.com/glossary/#prompt-injection)
- [Rug pull](https://aisecurityinterviews.com/glossary/#rug-pull)
- [Safetensors](https://aisecurityinterviews.com/glossary/#safetensors)
- [Spotlighting](https://aisecurityinterviews.com/glossary/#spotlighting)
- [System prompt leakage](https://aisecurityinterviews.com/glossary/#system-prompt-leakage)
- [Tool poisoning](https://aisecurityinterviews.com/glossary/#tool-poisoning)
- [Training data extraction](https://aisecurityinterviews.com/glossary/#training-data-extraction)

## Optional

- [FDEInterviews](https://fdeinterviews.com): Forward deployed engineer interviews, a sister site
- [AIInfraInterviews](https://aiinfrainterviews.com): AI infrastructure interviews, a sister site
- [InferenceInterviews](https://inferenceinterviews.com): Inference and GPU systems interviews, a sister site
- [AIPMInterviews](https://aipminterviews.com): AI product manager interviews, a sister site