Skip to content

Guardrails and safety: prompt injection, jailbreaks, output filtering

  • System design
  • Asked often
  • About 80 min to learn
  • 3 vetted resources
Build a plan that includes this

What this topic covers

Any LLM feature that reads untrusted text or can take actions is attackable: a user can try to jailbreak the model, and content the model reads (emails, web pages, tool results) can carry injected instructions. System-design rounds expect you to tell those two threat models apart, explain why no prompt wording fully fixes injection, and design layered defences: input and output screening, least-privilege tools, keeping third-party content in clearly delimited data slots, confirmation before irreversible or external actions, PII and sensitive-data handling, and monitoring. You should be able to walk through a concrete exfiltration attack and say which design choice would have stopped it.

Builds on

Leads to

You’re ready when you can

What interviewers check, from the resources below.

  • State the difference between a jailbreak/direct injection and an indirect injection, and who the adversary is in each
  • Design a lightweight pre-screen for user input and for tool output, and say what you do when the screening model itself refuses
  • Explain why untrusted content belongs in tool results (or JSON-encoded) rather than in the system prompt or plain user text
  • Apply least privilege: list what you would withhold from the model so a successful injection does little damage
  • Describe how you'd red-team your own agent before launch
  • Name the three capabilities of the trifecta and sketch an exfiltration attack that uses all three
  • Explain why an LLM cannot reliably tell instructions apart by their source
  • Argue why a probabilistic guardrail product is not a sufficient defence for a security property
  • Given an agent design, say which of the three capabilities you'd remove or gate behind a human confirmation
  • For each of the six scoped risks, give a one-line example attack and one concrete mitigation

What to study, in order

Each link opened and checked by hand; the date says when.

  1. Start here

    Mitigate jailbreaks and prompt injections (opens in a new tab)

    Claude Docs · Anthropic · 25 min · Free · checked 21 Oct 2026

    Why
    It splits the problem into the two threat models interviewers want you to distinguish (adversarial user vs adversarial content) and gives a concrete, layered defence list you can reproduce on a whiteboard.
    What to read
    Read “Jailbreaks and direct prompt injection” and “Indirect prompt injection” carefully, then skim “Continuous monitoring” and “Advanced: Chain safeguards”.
    What to skip
    The collapsed example prompts on a first pass, except the JSON-encoded tool result example, which is the clearest illustration of keeping untrusted content as data.

  2. Free alternative

    The lethal trifecta for AI agents: private data, untrusted content, and external communication (opens in a new tab)

    Simon Willison's Weblog · Simon Willison · 15 min · Free · checked 21 Oct 2026

    Why
    The “three capabilities together = exfiltration” framing is the fastest way to reason about any agent design in an interview and to explain why prompt-level guardrails are not a fix.
    What to read
    Read the whole post, from “The problem is that LLMs follow instructions in content” through “This is an example of the “prompt injection” class of attacks”.
    What to skip
    Nothing; if you have ten more minutes, follow the link to the author's 2023 post on worst-case scenarios for the original attack walkthroughs.

  3. Go deeper

    2025 Top 10 Risk & Mitigations for LLMs and Gen AI Apps (opens in a new tab)

    OWASP GenAI Security Project · OWASP Foundation · 40 min · Free · checked 21 Oct 2026

    Why
    It is the standard checklist security reviewers bring to an LLM design review, so knowing its categories lets you cover PII leakage, output handling and over-permissioned agents in one structured answer.
    What to read
    From the hub page open and read LLM01 Prompt Injection, LLM02 Sensitive Information Disclosure, LLM05 Improper Output Handling, LLM06 Excessive Agency, LLM07 System Prompt Leakage and LLM08 Vector and Embedding Weaknesses, focusing on each entry's mitigation list.
    What to skip
    LLM03 Supply Chain, LLM04 Data and Model Poisoning, LLM09 Misinformation and LLM10 Unbounded Consumption on a first pass; the “Document Versions and Translations” list.

Companies that test System design most

Put Guardrails and safety in your plan

Tell us your interview date and hours a day; it lands on the right day, in the right order.

Build my plan