Skip to content

LLM and agent security

  • System design
  • Asked often
  • About 1 h 30 min to learn
  • 3 vetted resources
Build a plan that includes this

What this topic covers

Once a model reads content it did not write (web pages, emails, retrieved chunks, tool output), that content can steer it. Prompt injection is therefore an untrusted-input problem, not a prompt-wording problem, and no classifier catches it reliably. Interviewers probe whether you can reason about blast radius: what data the agent can see, what actions it can take, and whether it can reach the outside world (the lethal trifecta). Expect follow-ups on excessive agency, system-prompt and PII leakage, poisoned vector stores, and how to scope and sandbox tools for coding agents. Strong answers name architectural patterns (dual LLM, plan-then-execute, sandboxing) rather than 'add a guardrail prompt'.

Builds on

Leads to

You’re ready when you can

What interviewers check, from the resources below.

  • State why detection-based defences cannot be relied on and what an architectural defence trades away
  • Describe each of the six patterns in one sentence and name the kind of task each still allows
  • Explain the Dual LLM pattern: what the quarantined model can and cannot influence
  • Pick a pattern for a given agent (email assistant, SQL agent, coding agent) and justify it
  • Trace the chain from untrusted file or issue text to a settings-file write to arbitrary command execution
  • Explain why an agent that can edit its own config files has effectively unrestricted agency
  • List which project files a coding agent must never write without approval (editor settings, tasks, MCP configs)
  • Map the exploit onto the three legs of the lethal trifecta and say which leg a sandbox removes
  • Distinguish direct from indirect injection and give a retrieval-based example of each
  • Name the four injection delivery methods (passive, active, user-driven, hidden) with one example apiece

What to study, in order

Each link opened and checked by hand; the date says when.

  1. Start here

    Design Patterns for Securing LLM Agents against Prompt Injections (opens in a new tab)

    Simon Willison's Weblog · Simon Willison · 25 min · Free · checked 21 Oct 2026

    Why
    When an interviewer asks 'how would you make this agent safe against injected instructions', they want architecture, and these six patterns are the vocabulary for that answer.
    What to read
    Read “The scope of the problem” through “The Context-Minimization pattern”, then skim “The case studies” and “Closing thoughts”.
    What to skip
    The linked 50-page paper itself; the post's summary of each pattern is enough for an interview.

  2. Free alternative

    GitHub Copilot: Remote Code Execution via Prompt Injection (CVE-2025-53773) (opens in a new tab)

    Embrace The Red · Johann Rehberger · 15 min · Free · checked 21 Oct 2026

    Why
    A real, fixed CVE in a coding agent is the most convincing example you can give of why tool scoping and sandboxing matter, and it maps directly onto the lethal trifecta.
    What to read
    Read “Background Research” (including “YOLO Mode”), “Exploit Chain Explained”, and “Recommendations and Fix”.
    What to skip
    “Video Walkthrough”, “Joining the Workstation to a Botnet - ZombAIs” and “Building an AI Virus”; fun, but the exploit chain is the lesson.

  3. Go deeper

    Not what you've signed up for: Compromising Real-World LLM-Integrated Applications with Indirect Prompt Injection (opens in a new tab)

    arXiv · Kai Greshake, Sahar Abdelnabi, Shailesh Mishra, Christoph Endres, Thorsten Holz, Mario Fritz · 40 min · Free · checked 21 Oct 2026

    Why
    This is the paper that defined indirect prompt injection; its threat taxonomy is what senior interviewers expect you to enumerate without prompting.
    What to read
    Read “1 Introduction” and all of “3 Attack Surface of LLM-Integrated Applications” (“3.1 Injection Methods”, “3.2 Threats”), then “5.6 Mitigations”.
    What to skip
    “4 Evaluation” and the appendix of prompts; the demonstrations are dated (Bing Chat, early Copilot) and the taxonomy is what lasts.

Companies that test System design most

Put LLM and agent security in your plan

Tell us your interview date and hours a day; it lands on the right day, in the right order.

Build my plan