You are building an agent that reads emails and web pages and can send messages and update a CRM. How do you protect it from indirect prompt injection?

What the interviewer wants to hear

• Assume prompts alone cannot stop injection
• Least privilege and scoped credentials for tools
• Human confirmation for sensitive or irreversible actions
• Isolate untrusted content and limit data flows out
• Detection, logging and red-team testing

Model answer

I start from the assumption that any text the agent reads may contain instructions, and no prompt can reliably make the model ignore them. So the main defences are in the architecture. Tools get least privilege: scoped credentials, read-only by default, and allowlists for recipients and domains. Sensitive actions such as sending external messages, changing records in bulk or sharing data require user confirmation showing exactly what will happen. I block common exfiltration paths, like rendering external images or links built from private data. Where possible, a step that reads untrusted content cannot also take high-risk actions in the same flow. I still mark untrusted content clearly in the prompt and add injection classifiers as extra layers. Finally, I log tool calls, alert on unusual patterns and red-team the agent with known injection techniques before and after launch.

More hard Prompt Engineer questions

• What is prompt injection, and how would you reduce the risk for an assistant that reads emails and can draft and send replies?
• Design an LLM-as-judge setup to evaluate a summarisation feature. How do you make it trustworthy?
• Your company is moving its prompts from one model provider to another. How do you plan and run the migration?
• You need an assistant that serves users writing in Hindi, Tamil and mixed Hinglish. What prompting and evaluation challenges do you expect?
• A high-volume prompt costs too much. How do you reduce cost while protecting quality?
• How would you evaluate a multi-step agent that completes tasks using tools, rather than a single prompt?
• How do you show with confidence that a new prompt is better than the current one, and not just lucky on your test set?
• Design a layered guardrail system for a public-facing LLM assistant. What goes where, and what are the trade-offs?
• An agent runs long tasks that exceed its context window. How do you manage context so quality stays high?