AI Security Interview Questions

Security-focused prompt engineering on jailbreaks, indirect injection, tool sandboxing, and layered defenses for production chatbots and agents.

Hard project question on LLM red-teaming — adversarial prompts, automation, severity rubrics, and fix-verify cycles.

MCP multiplies agent power and attack surface.

Prompt injection is the #1 security interview topic for agents that read untrusted text.

AI observability extends classic APM.

Hard prompt design on instruction stacking, jailbreak override attempts, and provider-specific precedence rules.

Hard AI Agents interview question on browser agents and computer use risks — architecture, trade-offs, eval, and production patterns.

Hard RAG interview question on rag security: data leakage and prompt injection — architecture, trade-offs, eval, and production patterns.

Hard scenario on jailbreaks — DAN, prompt injection, alignment limits, red-teaming, and layered defenses.

Enterprise RAG interviews test system design at scale: ACL-aware retrieval, audit logging, and ingestion pipelines for millions of documents. This is a staff-level question appearing at Microsoft, Salesforce, and Fortune 500 AI teams. Walk through a complete architecture with security boundaries and operational concerns.

A production Claude Code rollout is an agent platform problem, not a 'give everyone a CLI' problem.

Repository configuration attacks target the files agents trust.

Governance is becoming the bottleneck — not model IQ.

Medium MCP product/security question on consent UX for side-effecting tools.

Hard vector DB question on tenant isolation, noisy neighbors, and ACL safety.

**Architecture** LangGraph with interrupt before sensitive tools (lg-004); Bedrock or enterprise API.

**Desktop host** Users add MCP servers in config; stdio local servers common.

**Diagnosis** Categorize refusals: policy vs ambiguous vs bug; replay with rubric.

**Mechanics** Assistant message may include tool_use blocks with id, name, input JSON; user message returns tool_result tied to id.

**Storage** Vector + structured facts table keyed by user_id; version memories on conflict.

**Common failures** Model calls nonexistent tool; args wrong type; parallel tool_calls partial failure; streaming partial JSON; user content tricks model into exfil tool args.

Company-based MCP questions assess platform leadership, not wire protocols alone.

MCP testing maturity separates hobby servers from production integrations.

MCP supply-chain interviews mirror DevSecOps — because installing a server is installing code with tool access.