1 min lesson
Agent-security rapid fire
Put this idea into your own words: "The AI/agent-security deep dive is where this role's edge shows."
Step 1 of 3
The AI/agent-security deep dive is where this role's edge shows. Cursor builds agents that read, write and execute code on customer systems, which is a threat surface off-the-shelf playbooks don't cover. Expect rapid Q&A: crisp one-paragraph answers that diagnose the threat, name a mitigation and admit the residual risk.
The unifying frame to carry into every answer is the lethal trifecta: an agent that has access to private data, can be exposed to untrusted content and can communicate externally is the dangerous combination. Remove any one leg and the worst exfiltration paths close. Say that frame out loud - it shows you reason about the system, not the individual prompt.
Learn more
Advanced table
Each answer names the boundary first - that's what's being scored
- Question
- Indirect prompt injection?
- One-paragraph answer (shape)
- Untrusted content the agent reads (a file, a web page, an issue comment) carries instructions it then follows. Diagnose: the trust boundary between content and instructions has collapsed. Mitigate: treat all tool output as data not commands, constrain capabilities, require human confirm on high-impact actions. Residual: you can't fully sanitize natural language, so assume injection and contain blast radiusHow much breaks if a change goes wrong; the scope of potential damage. Press Enter for the full definition..
- Question
- MCPModel Context Protocol. A standard that lets an AI agent pull in context from outside the repo, like Jira tickets or internal docs. Press Enter for the full definition. / tool-use risk?
- One-paragraph answer (shape)
- An MCPModel Context Protocol. A standard that lets an AI agent pull in context from outside the repo, like Jira tickets or internal docs. Press Enter for the full definition. server or tool the agent trusts can return malicious payloads or expose more capability than intended. Diagnose: every tool is a new trust boundary and a new privilege. Mitigate: least-privilege tool scoping, allowlist servers, validate tool I/O, no implicit credential passthrough. Residual: a compromised trusted server is still a supply-chain risk you monitor, not eliminate.
- Question
- Command-execution abuse?
- One-paragraph answer (shape)
- Injected or misguided instructions get the agent to run a destructive or exfiltrating command. Diagnose: the agent→host execution boundary. Mitigate: run in a sandbox with deny-by-default egress, no standing cloud creds, human approval for irreversible actions. Residual: sandbox-escape bugs exist, so defense in depth and monitoring, not a single wall.
- Question
- Context exfiltration?
- One-paragraph answer (shape)
- Secrets or other tenants' code leak out through the model context - logged, sent to a tool or echoed to an attacker. Diagnose: data crossing the model-context boundary. Mitigate: redact secrets before they enter context, tenant isolation, egress controls, data-retention limits. Residual: minimize what's in context, because anything in context can leak.
| Question | One-paragraph answer (shape) |
|---|---|
| Indirect prompt injection? | Untrusted content the agent reads (a file, a web page, an issue comment) carries instructions it then follows. Diagnose: the trust boundary between content and instructions has collapsed. Mitigate: treat all tool output as data not commands, constrain capabilities, require human confirm on high-impact actions. Residual: you can't fully sanitize natural language, so assume injection and contain blast radiusHow much breaks if a change goes wrong; the scope of potential damage. Press Enter for the full definition.. |
| MCPModel Context Protocol. A standard that lets an AI agent pull in context from outside the repo, like Jira tickets or internal docs. Press Enter for the full definition. / tool-use risk? | An MCPModel Context Protocol. A standard that lets an AI agent pull in context from outside the repo, like Jira tickets or internal docs. Press Enter for the full definition. server or tool the agent trusts can return malicious payloads or expose more capability than intended. Diagnose: every tool is a new trust boundary and a new privilege. Mitigate: least-privilege tool scoping, allowlist servers, validate tool I/O, no implicit credential passthrough. Residual: a compromised trusted server is still a supply-chain risk you monitor, not eliminate. |
| Command-execution abuse? | Injected or misguided instructions get the agent to run a destructive or exfiltrating command. Diagnose: the agent→host execution boundary. Mitigate: run in a sandbox with deny-by-default egress, no standing cloud creds, human approval for irreversible actions. Residual: sandbox-escape bugs exist, so defense in depth and monitoring, not a single wall. |
| Context exfiltration? | Secrets or other tenants' code leak out through the model context - logged, sent to a tool or echoed to an attacker. Diagnose: data crossing the model-context boundary. Mitigate: redact secrets before they enter context, tenant isolation, egress controls, data-retention limits. Residual: minimize what's in context, because anything in context can leak. |
Each answer names the boundary first - that's what's being scored.
Notice the common spine: every answer starts by naming the trust boundary that's being crossed. “The boundary between content and instructions” for injection, “the agent-to-host execution boundary” for command abuse. Naming the boundary is the senior signal; jumping straight to “add a guardrail prompt” is the junior one.