AI security interview prep: prompt injection, agents, and model risk

The fastest-growing gap in security hiring

AI security is the newest interview vertical, and most candidates walk in with zero repeatable framework for it. Application security experience built for deterministic code does not transfer cleanly to a system that follows instructions found inside its own input, which is exactly why interviewers now probe for this even in generalist AppSec loops.

The candidates who stand out are not the ones who memorized a jailbreak prompt — they are the ones who can explain why prompt injection cannot be patched at the model layer and reach for layered, defense-in-depth controls instead.

Know the failure modes cold

Six patterns cover most of what gets asked: direct prompt injection, indirect injection through retrieved content (RAG poisoning), unsafe handling of model output, over-scoped agent tool permissions, model supply chain risk, and production monitoring for jailbreak attempts.

• Prompt injection: the model has no structural boundary between instructions and data
• Indirect injection: attacker content planted in a document or forum post gets retrieved and treated as an instruction
• Output handling: model output is untrusted and must be escaped or sanitized like any other input, not rendered as raw HTML
• Agent tool scope: excessive agency turns a narrow task into a broad blast radius
• Supply chain: an untrusted model checkpoint can execute code on load, not just serve predictions
• Monitoring: detection has to catch what prevention misses, from injection-shaped prompts to anomalous usage

Practice the reasoning, not the vocabulary

Reading a glossary of LLM attack terms does not build the judgment interviewers grade. Short missions that hand you a prompt-building path, an agent's tool config, or a gateway log and ask you to name the control that breaks the abuse path build the same reasoning an interview scenario tests.

After each mission, say the answer out loud in under two minutes: what the risk is, why it exists structurally, and what control closes it. That is the same shape every AI security interview answer needs.

Stay defensive and grounded in real controls

AI security practice should sharpen judgment about scoping, validation, and monitoring for authorized systems you are defending — never a guide to building a working jailbreak. Ground every answer in a concrete control (tool scoping, output sanitization, source trust tiers) rather than a vague appeal to 'better prompting.'