1 min lesson
Agent-security rapid fire
Describe what "Expect an agent-security deep dive to be where this role's edge shows" changes in practice.
Step 1 of 3
Expect an agent-security deep dive to be where this role's edge shows. Cursor builds agents that read, write and execute code on customer systems, a threat surface few off-the-shelf playbooks cover. Plan for rapid Q&A: crisp one-paragraph answers that diagnose the threat, name a mitigation and admit the residual risk.
The unifying frame to carry into every answer is the lethal trifecta: an agent that has access to private data, can be exposed to untrusted content and can communicate externally is the dangerous combination. Remove any one leg and the worst exfiltration paths close. Say that frame out loud; it shows you reason about the whole system.
Learn more
Advanced table
Each answer names the boundary first. That is the habit to build
- Question
- Indirect prompt injection?
- One-paragraph answer shape
- Untrusted content the agent reads, like a file, a web page or an issue comment, carries instructions it then follows. Diagnose: the trust boundary between content and instructions has collapsed. Mitigate: treat all tool output as data, constrain capabilities and require human confirmation on high-impact actions. Residual: you can't fully sanitize natural language, so assume injection and contain the blast radiusHow much breaks if a change goes wrong; the scope of potential damage. Press Enter for the full definition..
- Question
- MCPModel Context Protocol. A standard that lets an AI agent pull in context from outside the repo, like Jira tickets or internal docs. Press Enter for the full definition. / tool-use risk?
- One-paragraph answer shape
- An MCPModel Context Protocol. A standard that lets an AI agent pull in context from outside the repo, like Jira tickets or internal docs. Press Enter for the full definition. server or tool the agent trusts can return malicious payloads or expose more capability than intended. Diagnose: every tool is a new trust boundary and a new privilege. Mitigate: least-privilege tool scoping, allowlist servers, validate tool I/O, no implicit credential passthrough. Residual: a compromised trusted server is still a supply-chain risk you monitor, not eliminate.
- Question
- Command-execution abuse?
- One-paragraph answer shape
- Injected or misguided instructions get the agent to run a destructive or exfiltrating command. Diagnose: the agent→host execution boundary. Mitigate: run in a sandbox with deny-by-default egress and no standing cloud creds, and require human approval for irreversible actions. Residual: sandbox-escape bugs exist, so layer defenses and monitor instead of trusting a single wall.
- Question
- Context exfiltration?
- One-paragraph answer shape
- Secrets or other tenants' code leak out through the model context by being logged, sent to a tool or echoed to an attacker. Diagnose: data crossing the model-context boundary. Mitigate: redact secrets before they enter context, tenant isolation, egress controls, data-retention limits. Residual: minimize what's in context, because anything in context can leak.
| Question | One-paragraph answer shape |
|---|---|
| Indirect prompt injection? | Untrusted content the agent reads, like a file, a web page or an issue comment, carries instructions it then follows. Diagnose: the trust boundary between content and instructions has collapsed. Mitigate: treat all tool output as data, constrain capabilities and require human confirmation on high-impact actions. Residual: you can't fully sanitize natural language, so assume injection and contain the blast radiusHow much breaks if a change goes wrong; the scope of potential damage. Press Enter for the full definition.. |
| MCPModel Context Protocol. A standard that lets an AI agent pull in context from outside the repo, like Jira tickets or internal docs. Press Enter for the full definition. / tool-use risk? | An MCPModel Context Protocol. A standard that lets an AI agent pull in context from outside the repo, like Jira tickets or internal docs. Press Enter for the full definition. server or tool the agent trusts can return malicious payloads or expose more capability than intended. Diagnose: every tool is a new trust boundary and a new privilege. Mitigate: least-privilege tool scoping, allowlist servers, validate tool I/O, no implicit credential passthrough. Residual: a compromised trusted server is still a supply-chain risk you monitor, not eliminate. |
| Command-execution abuse? | Injected or misguided instructions get the agent to run a destructive or exfiltrating command. Diagnose: the agent→host execution boundary. Mitigate: run in a sandbox with deny-by-default egress and no standing cloud creds, and require human approval for irreversible actions. Residual: sandbox-escape bugs exist, so layer defenses and monitor instead of trusting a single wall. |
| Context exfiltration? | Secrets or other tenants' code leak out through the model context by being logged, sent to a tool or echoed to an attacker. Diagnose: data crossing the model-context boundary. Mitigate: redact secrets before they enter context, tenant isolation, egress controls, data-retention limits. Residual: minimize what's in context, because anything in context can leak. |
Each answer names the boundary first. That is the habit to build.
Notice the common spine: every answer starts by naming the trust boundary being crossed. For injection it is "the boundary between content and instructions"; for command abuse it is "the agent-to-host execution boundary." Name the boundary first, then reach for a mitigation.