Anthropic Safety, Security & Governance interview questions

The security question every agent PM must answer well. Anyone can send your user an email, which means anyone can put instructions in front of the model. The strong answer stops trying to make the model resist and limits what a fooled model can do.

The top entry on the OWASP list for LLM applications. A PM should be able to explain it in a minute, distinguish the direct and indirect forms, and explain why it changes how products are designed.

A red team that ends in a slide deck changes nothing. The interviewer wants a plan with scope, people, severity ratings, exit criteria, and a way to turn findings into permanent tests.

Part incident response, part communications, part safety engineering. The interviewer wants a calm sequence: verify, contain, fix the class of attack rather than the one prompt, and communicate honestly.

A frontier lab question where product, safety and business pressure meet. The interviewer wants a release process with pre-committed thresholds, staged access, and the willingness to delay.

A common event with a calm answer. The leak itself is usually not the problem; what the prompt contained and what it was being trusted to do might be.

Separate disabling access from completing erasure, and explain what evidence supports each part of the deletion promise.

Translate a research result into a product-specific threat, a testable control and an operating plan with enough capacity to work.

Untrusted pages, private data and the ability to act or send are each manageable alone and dangerous together. Set a rule for combinations, then decide where a person must confirm.

One open registry was found with 341 malicious skills out of 2,857. Decide publisher identity, version pinning, metadata rules and how fast you can pull a listing.

Security bugs and content jailbreaks need different handling. Pay well for impact on users and data, route model-behaviour reports elsewhere, and run targeted challenges when you want jailbreak testing.

Several clocks start at once, some measured in hours. Classify the incident against each regime, start each clock at awareness and file before causation is settled.

Courts have treated training and acquisition differently, and memorised output differently again. Decide how the data is obtained, what the model may reproduce and which markets carry which risk.

Lab frameworks anticipate this situation and set conditions for adjusting. Decide what can move, what stays unilateral and how you say it in public.

The same capability defends and attacks. Two labs chose verified access for defenders instead of general release. Design the tiers, the verification and what blocked legitimate users can do.

Shipping weights to a customer moves them outside every control you built. Decide which models may leave, what the customer's environment must prove and what you offer instead.

Hiring is one of the clearest high-risk uses under the EU AI Act. The interviewer wants to see you turn obligations into product requirements and a roadmap, with dates stated carefully.

Enterprise deals stall on this question. 'The provider doesn't train on our data' answers one of five different questions. The interviewer wants the full set and a clear answer to each.

A vocabulary check with a practical edge. Knowing the list matters less than turning it into requirements for a specific product.

A textbook confused-deputy attack on a powerful agent. The interviewer wants the mechanism, the full set of controls (sandbox, network, secrets, approvals), and a response plan for the disclosure.

India's Digital Personal Data Protection framework is now in force in phases. The interviewer wants the principles turned into product requirements, stated as of a date and checked with counsel.

US AI regulation is a moving patchwork on top of long-standing lending law. The interviewer wants a product plan that holds up whichever way state laws go: explainability, fairness testing, human review and documentation.