Senior interview questionAsked at Meta · interview write-up
How do you keep a coding agent from leaking private code, both through training and at inference time?
Model answer
Training: don't train on customer code without opt-in; where you do, dedupe, scrub secrets, and test memorisation by prompting with code prefixes, since models can regurgitate training data verbatim. Inference: prompts land in logs and caches, so scope them per tenant, encrypt them and set retention.
Scroll sideways to see the whole diagram
A model can be trained to rank instructions by where they come from, so a tool output loses to the system prompt.
Text version
- A model can be trained to rank instructions by where they come from, so a tool output loses to the system prompt.
- The prompt can name what is off-limits and mark untrusted text as data. Both rely on the model complying.
- System-level defences don't depend on the model: a tool it doesn't have can't be misused, and a send that needs approval can be declined.
- Layers reduce risk; none removes it. Plan for an attack that gets through.
Levels from AI Engineering, Ch. 5, "Defenses Against Prompt Attacks"; measures from OWASP LLM01:2025.
The agent itself is a channel: a poisoned file or issue can tell it to send code out. Sandbox execution with no outbound network by default, allow-list destinations, keep secrets out of context, and require approval for pushes and external calls.
Practise the rest
12 Prompt injection questions, 492 in all, each with a model answer. Free.
More from Meta interview questions.
More Prompt injection interview questions
- Why is prompt injection possible at all, and why can't it be fixed the way special-token injection is?
- What is the difference between direct and indirect prompt injection? Give an example of each.
- Your assistant has no tool that sends anything. Can an injected web page still leak the user's data?
- You're designing an email assistant that reads, summarises and forwards mail. Which defences do you put in, and where?
- A reviewer says: “The system prompt forbids following instructions in emails, so the forward tool is safe, and our red-team run had zero violations.” Do you accept that?
- What's the difference between a jailbreak and a prompt injection?