Mid-level interview question
Your assistant has no tool that sends anything. Can an injected web page still leak the user's data?
Model answer
Yes. In OWASP's scenario, hidden instructions on a page make the model put an image link to an outside address in its reply, and loading it leaks the conversation. Anything the reply makes the browser fetch can carry data out, so check outputs as well as tool permissions. Beyond that, impact depends on "the agency with which the model is architected".
Practise the rest
12 Prompt injection questions, 492 in all, each with a model answer. Free.
More Prompt injection interview questions
- Why is prompt injection possible at all, and why can't it be fixed the way special-token injection is?
- What is the difference between direct and indirect prompt injection? Give an example of each.
- You're designing an email assistant that reads, summarises and forwards mail. Which defences do you put in, and where?
- A reviewer says: “The system prompt forbids following instructions in emails, so the forward tool is safe, and our red-team run had zero violations.” Do you accept that?
- What's the difference between a jailbreak and a prompt injection?
- Do XML tags or delimiters around untrusted text stop prompt injection?