1 min lesson
Untrusted input is everywhere
Rebuild the main list in "Untrusted input is everywhere", then say what each item changes.
Step 1 of 2
Untrusted input is everywherethe surface is wider than candidates expect
- Repo contents - a comment, README or test fixture can carry an injected instruction the agent reads while working.
- Web pages and search results - the moment the agent browses, it ingests attacker-controlled HTML.
- Tool and command outputs - a linter, a curl response or a build log the agent reads can be poisoned.
- MCPModel Context Protocol. A standard that lets an AI agent pull in context from outside the repo, like Jira tickets or internal docs. Press Enter for the full definition. servers - every connected server returns content the model treats as context and you may not control that server.
- Prior agent turns - output the agent generated earlier can re-enter context and reinforce a hijack.
Cursor built a security-specific threat model
General-purpose security tooling can't be tuned to an agent that edits and executes code on customer systems, so Cursor wrote its own model of the surface. The takeaway for your interview: don't reach for a generic OWASP checklist. Reason from the agent's trust boundaries and what an attacker controls at each one.
Interview move
Frame every answer around three actors and the boundaries between them: the model, its tools and the user's system. When you get a scenario, locate where attacker-controlled content enters and where data or actions can leave, then design the mitigation at that boundary. That structure alone reads as senior.