What is prompt injection, how do direct and indirect attacks differ, and how do you defend against them?

The interviewer wants to know whether you realize that a model cannot tell your instructions apart from text someone else wrote, and whether you put your protection where it can be trusted rather than in a note inside the prompt.

Prompt injection happens when text controlled by someone else gets into the context and makes the model behave in ways you did not intend. A direct attack is when the user's own message does it, for example "ignore all previous instructions". An indirect attack is when the text sits inside data the agent reads, such as a notes field, a web page or a document, and the user may not even have written it. OWASP ranks this as the number one risk for applications built on language models, and notes that it is unclear whether there is any foolproof way to prevent it.

That is why the defenses belong in code: least privilege (the agent has no tools for sensitive actions such as refunds, it only hands the case to a person), permission checks inside each tool using an identity your application authenticated rather than one the model claims, putting only the fields it needs into the context, filtering the output, and having a human approve high-risk actions. Instructions in the system prompt and marking content as untrusted are still worth doing, but they are an extra layer only.

You should also say that an output filter based on regular expressions can always be bypassed by rephrasing, and it can block correct sentences by mistake, so you have to test it with both bad and good inputs.

Bonus points: mention turning the attacks you know about into tests you can rerun, and note that testing with a fake model only proves the code around the model, not the behavior of the real model.