How would you protect an LLM application that reads emails and can take actions, against prompt injection and data leaks?

What the interviewer wants to hear

• Treat all external content as untrusted data
• Least privilege tools and scoped credentials
• Human confirmation or policy checks for sensitive actions
• Input and output filtering, PII and secret detection
• Logging, monitoring, red teaming

Model answer

I assume prompt injection will happen, because any email can contain instructions written for the model. So the design must stay safe even if the model is fooled. First, untrusted content is clearly separated from instructions and treated as data. Second, least privilege: the agent only gets tools it needs, with scoped credentials, for example read-only access by default and sending only to allowlisted domains. Third, sensitive actions such as sending email, deleting data or making payments go through code-level policy checks and user confirmation that shows exactly what will happen. Fourth, I block common exfiltration routes, like rendering external image links containing data, and scan outputs for secrets and personal data. Finally I log every tool call, monitor for unusual patterns, and run regular red-team tests with known injection attacks in my eval suite.

More hard AI Engineer (LLM & Generative AI) questions

• Design a RAG assistant over 2 million internal documents with different access permissions per team.
• An agent that completes multi-step tasks works in demos but fails often in production. How do you make it reliable?
• Your LLM feature costs too much and p95 latency is 9 seconds. Walk through how you would reduce both without hurting quality.
• When would you fine-tune a smaller open-weight model instead of using a large hosted model, and how would you do it?
• You must self-host an open-weights LLM for a high-traffic product. How do you plan memory, throughput and latency?
• Users say your AI assistant got worse this week, but nothing obvious changed. How do you investigate?
• How do you design an LLM-as-judge evaluation you can actually trust?
• When would you choose a multi-agent architecture over a single agent or a fixed workflow?
• Your agent will connect to several MCP servers, some built by third parties. How do you make this secure?