Prompt injection is input crafted to make a model follow instructions its developer did not intend. Direct injection arrives in the user’s own message; indirect injection hides in content the model reads while it works, such as a retrieved document, an email, a web page or a tool result (Greshake et al., indirect prompt injection). OWASP says it is unclear whether fool-proof prevention exists, and pairs input and output filtering with limits on what an injected instruction can make the system do (OWASP, prompt injection).
In FDE interviews
Decagon’s Deployment Engineer posting puts layered guardrails in the agent builds the hire owns, and a Blind poster relaying a Google Senior phone screen in July 2026 listed safety guardrails among its agent design topics. Source 1Agent Deployment Engineer @ Decagon (San Francisco)PublisherDecagon (Ashby job board)Source typecompany job postingSource 2Google Forward Deployed Engineer Interview ExperiencePublisherBlind (teamblind.com)Source typecandidate report on Blind Raise injection first in any design where an assistant reads customer content and can act, such as a refund agent or an inbox triage tool; “we’ll filter the prompts” is the weak answer.
A strong candidate looks for the combination that makes injection costly, which Simon Willison calls the lethal trifecta: private data, untrusted content and a way out, such as a rendered link or image URL, an outbound HTTP tool or an email send. They cut at least one of the three, treat every retrieved document and tool result as untrusted, keep the model that reads that content from holding write tools, give each tool least privilege, and require a person’s confirmation before any action that moves money or data. Then they name what is left: a poisoned document can still skew the summary it appears in; the design only stops it from acting.
Related: agent, Model Context Protocol, trust boundary.