Hard20 minAI Engineering
UpdatedAug 6, 2026
Edit

Prompt Injection in Support AI

Question Variations

  • "Why can't prompt wording alone prevent injection?"
  • "How would you test an agent against retrieved malicious text?"
  • "How would you secure a support assistant that reads untrusted emails before using account tools?"

Why This Is Asked

This tests whether a candidate understands prompt injection as an application-security problem rather than a prompt-writing problem. Interviewers assess untrusted-context handling, capability controls, authorization, and adversarial evaluation.

Key Concepts

  • Untrusted context: Retrieved text is data, not privileged instruction.
  • Capability controls: Sensitive actions require server-side authorization and confirmation.
  • Data minimization: Give the model only the context and tools required.
  • Testing: Red-team direct and indirect injections continuously.

Question Variations

  • “Why can’t prompt wording alone prevent injection?”
  • “How would you test an agent against retrieved malicious text?”
  • “How would you secure a support assistant that reads untrusted emails before using account tools?”

Answers by Technology

+ Add Variant
System DesignImprove this answer ✏️

Expected Answer

I assume every email and retrieved page may contain hostile instructions. The system prompt can guide the model, but cannot be the security boundary. I minimize context and available tools, enforce authorization and confirmation in server code, and test direct and indirect injections continuously. Sensitive actions require a policy decision based on the authenticated user, never a sentence generated by the model.

Why It Matters

Hostile text can manipulate a model that has access to customer tools.

Common Mistakes

  • Relying on system-prompt wording: It cannot guarantee safety.
  • Giving broad tools by default: Injection gains unnecessary capability.

Follow-up Questions

  • What is indirect injection? (Answer: Hostile instructions delivered through external content.)
  • What enforces safety? (Answer: Server-side policy and scoped tools.)