prompt injection

Guardrails are often described as a box in a diagram. The interviewer wants specific checks, where each runs, what it costs in latency, and what happens when one fires.

Experiments show agent buyers favour whoever answers first and can be redirected by injected text. Allow structured exchange, treat the other agent as untrusted and keep hard limits outside the model.

The security question every agent PM must answer well. Anyone can send your user an email, which means anyone can put instructions in front of the model. The strong answer stops trying to make the model resist and limits what a fooled model can do.

The top entry on the OWASP list for LLM applications. A PM should be able to explain it in a minute, distinguish the direct and indirect forms, and explain why it changes how products are designed.

A textbook confused-deputy attack on a powerful agent. The interviewer wants the mechanism, the full set of controls (sandbox, network, secrets, approvals), and a response plan for the disclosure.

Untrusted pages, private data and the ability to act or send are each manageable alone and dangerous together. Set a rule for combinations, then decide where a person must confirm.