prompt injection

Candidates who say 'everything is new' and candidates who say 'nothing is new' both lose this one. The answer that scores names exactly three differences and keeps the rest of the toolkit.

Five minutes, no jargon, one decision. Candidates who explain how attention works have already lost the room.

An agent that renames 4,000 functions overnight is a real gain. An agent that confidently explains what a function does without checking is a liability. Interviewers want both halves and the controls in between.

An LLM reviewer reads every change, which no human team can, and is confidently wrong some of the time. The scored answer places it as a triage layer, measures it, and protects it from the code it reads.

Everything shipped on the phone belongs to the person holding it: the weights, the system prompt and any key the assistant uses. And the assistant now reads notifications, messages and screens written by strangers.

CI already mixed untrusted input with powerful tokens. Adding an agent that reads issue text and can act turns a shell-injection problem into a prompt-injection problem. The scored answer fixes both.

The single idea underneath most AI security answers. The scored part is the second half: the architectural moves that follow once you accept it.

Three parts, each short. The answer that scores ends with a design rule about what may and may not live in a prompt.

Longer thinking helps the model resist some attacks and gives others more room. The scored answer covers the reasoning trace as data, as a monitoring signal, and as an attack surface.

Compare the control each interpreter enforces. Then review a fictional document-ranking feature without mistaking valid syntax, visible text or human review for permission.

Map the author, entry route and executing identity. Compare two fictional systems using reachable consequences, then explain what evidence could reverse your judgment.

Classify overlapping policy failures without assigning severity by label. Review a prohibited draft, a denied publication and an uncertain audience, then allocate the repairs.

Separate observed model resistance from a precisely enforced application rule. Examine the evidence, assumptions and remaining consequences before recommending a release.

Map each control to a specific read, operation or release. Check policy inputs, audience permissions, verdict timing and useful work instead of relying on defense labels.

Interpret the attack and benign counts, trace a detector miss to its actual consequence, and specify the verdict timing and fallback needed for deployment.

Verify exact text, confidential facts and invented reconstruction against the right source. Then scope the audience, impact and failed delivery path.

Use the historical EchoLeak advisory and an original worked trace to distinguish delivery, actual exposure, generated output and release. Choose verifiable controls without implying the old vulnerability remains open.

Separate source cues, message integrity, learned instruction priority and service permissions. Compare the actual configurations on both violations and useful manual-reading work.

Compare actual sources, identities, audiences, effects and persistence. Review what tools add without dismissing text-only harms or assuming user-scoped credentials authorize every task.

Separate Unicode normalization, hidden controls, bidirectional display and confusable identifiers. Use a harmless offline example to choose field-specific checks without damaging legitimate language.

Design signals that distinguish suspicious inputs, unauthorized proposals, blocked operations and confirmed exposure. Test response timing, evidence handling and monitoring health.

Trace actual text, image and audio inputs, then distinguish extraction errors, unauthorized influence and completed effects. Build a useful test plan without inventing success rates.

Turn a filter-based launch claim into an actionable decision note: evidence, permission gaps, useful interim scope, owners and completion conditions.

Build an authorized evaluation with synthetic identities, a fidelity matrix and controlled effects after real permission checks. Report what the harness proves and what remains untested.

Compare controller-enforced workflows with mediated planner inputs. Trace opaque values, bounded fields, runtime branches and retries to the actual permission decision.

Review capability metadata, trusted labels, derived values and actual release policy. Work through allowed sharing, forbidden audiences, branch influence and uncovered runtime paths.

Design around actual read, draft, preview and send audiences. Bind current grants and approvals to the operation, handle queued changes and evaluate the content risks that remain.

Trace editable source material through retrieval, actual context, model behavior and observed effects. Work through a synthetic result with denied proposals and an unresolved receipt.

Write a release record with consequence-specific requirements, enforcement assumptions, measured task quality and unresolved outcomes. Name the decision owner and reopening conditions.

Use the seven-stage research framework without forcing every incident through every stage. Work a partial trace, model alternate paths and separate stored state from observed downstream influence.

Map protected context to its actual readers. Distinguish unauthorized retrieval from redistribution, inspect drafts and rendering, and verify disclosure without assuming every prompt inevitably leaks.

Investigate message construction, intended instruction conflicts and actual effects. Distinguish a misleading promise from a service failure, and test the correct permission rule.

The question catches candidates who think exfiltration needs a tool. The answer that scores starts with the browser and ends with deterministic controls in the client.

The assistant becomes a new client of every API the product has, with a confused-deputy problem built in. The scored answer finds the new trust boundaries and keeps the old access model intact.

Distinguish metadata review from runtime authorization. Work through an uncalled tool, a changed definition and a server whose behavior changes without new metadata.

Follow the write, retrieval and execution paths separately. A remembered claim can persist without becoming policy; prove which records later tasks receive and which actions the resource service permits.

Contain affected authority, preserve evidence in parallel and reconcile actual effects. Work through shared inputs, queued jobs, uncertain outcomes and a tested path back to useful service.

Repository instructions can influence a model; configuration can change execution. Trace creation, replacement and startup before deciding where approval must hold.

Browser origin isolation still applies to web content. Explain the separate authority of an agent that reads and acts across sites, then constrain data flow, destinations and consequential actions at the agent boundary.

A skill is instructions plus code that runs with the agent's own permissions, with no process boundary in between. The scored answer reviews it like software and like a prompt, because it is both.

Two different attacks hide in 'malicious images'. One writes instructions a model can read; the other optimises pixels to push the model's internal representation. They need different tests and different defences.

Read benchmark scores through their tasks, budgets, scoring rules and missing outcomes. Work through a joint security-and-utility example before applying a result to your product.

Compare actual configurations with paired evidence, separate adaptive budgets and useful-task checks. A lower rate or significant test does not settle the release decision.