Direct versus indirect injection and agent defenses

WHAT THIS TESTS The interviewer wants to see that you understand why autonomous, tool-using agents dramatically raise injection risk, especially via untrusted external content, and that you can design layered, least-privilege defenses rather than a single filter.

A GOOD ANSWER COVERS The distinction: direct prompt injection is when the attacker is the user, typing instructions that try to override the system prompt. Indirect prompt injection is when malicious instructions are planted in third-party data the agent consumes, a web page it browses, a document it retrieves, an email it reads, or an API response, so the agent encounters the payload as ordinary content and may execute it, even though the human user is innocent. Indirect injection is especially dangerous for agents because they can take real-world actions through tools. Multi-layered defense: first, treat all fetched and retrieved content as untrusted, delimit and label it clearly as data, and run injection detectors and content sanitization before it enters the prompt. Second, apply least privilege to tools and APIs, scope credentials narrowly, restrict which actions are callable in a given context, and avoid giving the agent broad write or financial capabilities by default. Third, require explicit human confirmation for high-impact or irreversible actions like sending money, deleting data, or emailing externally. Fourth, monitor and log all tool calls and outputs, add anomaly detection and rate limits, and run output guardrails. Defense in depth means no single bypass is catastrophic.

COMMON WRONG ANSWERS Addressing only direct injection and trusting browsed or retrieved content. Relying on a single system-prompt instruction to ignore injections. Granting the agent broad tool permissions and no human-in-the-loop. Assuming output filtering alone protects against malicious actions.

LIKELY FOLLOW-UPS Why is indirect injection worse for agents, it triggers real actions. How does least privilege limit blast radius. When require human confirmation. How do you detect anomalous tool sequences.

ONE CONCRETE EXAMPLE An agent summarizing a web page hits hidden text saying transfer funds using the payment API. With untrusted-content labeling, a scoped read-only tool set, and human confirmation gating any payment, the injected instruction is contained instead of executed.