TL;DR: Name the 2025 list grouped in thirty seconds, then prioritize LLM01 (prompt injection) and LLM06 (excessive agency) for an enterprise agent, because injection is the entry point and excessive agency is what turns it into a breach. Make the call explicit that priorities shift with architecture (RAG-heavy raises LLM08/LLM02; fine-tuning on user data raises LLM04).
How to approach it
"Walk me through" is bait for a ten-minute recitation. Don't take it. Name the list at speed, thirty seconds, grouped, then spend your time on the actual question: which two you'd prioritize for an agent, and why the answer changes with deployment shape. The interviewer is scoring threat-model judgment, not flashcards.
A strong answer
The 2025 list, grouped so it's clear you understand it rather than memorized it: input-side risks (LLM01 prompt injection, LLM04 data and model poisoning, LLM08 vector and embedding weaknesses), disclosure risks (LLM02 sensitive information disclosure, LLM07 system prompt leakage), action-side risks (LLM05 improper output handling, LLM06 excessive agency), and platform risks (LLM03 supply chain, LLM09 misinformation, LLM10 unbounded consumption).
The two shaded boxes are the pair I lead with for an agent, and the arrow between them is the whole argument.
For an enterprise agent, something with tool access touching email, tickets, or internal APIs, I'd prioritize LLM01 (prompt injection) and LLM06 (excessive agency), and I'd argue they're really one combined threat. Injection is the attacker's entry point; excessive agency is what converts it from "model said something weird" into "model emailed our customer list to an attacker." An agent that reads inbound content and holds write-capable tools is the canonical lethal combination. Concretely: every retrieved document, email, and tool result is untrusted input; every tool call is a privilege decision. So the controls are scoped, short-lived credentials per tool per user (not a god-token in the agent runtime), allowlisted tools per task, human confirmation gates on irreversible or external-facing actions, and treating tool results as another injection vector, not just user input.
The agency audit from the testing probe below is worth showing as the table it actually is, because "enumerate every tool and its worst case" sounds like process until you fill in four rows for a real support agent:
| Tool | Credential scope | Worst case under injection | Verdict |
|---|---|---|---|
search_tickets | Read, scoped to requesting user | Attacker phrasing surfaces in a summary | Allow |
update_ticket_status | Write, internal, reversible | Tickets wrongly closed; annoying, undoable | Allow, log |
send_email | External send as the org | Exfiltration channel and phishing-at-scale from your domain | Human gate |
issue_refund | Money moves, irreversible | Poisoned ticket text triggers real payouts | Human gate plus per-day cap |
Two rows sailed through and two hit gates, which is the point: the audit is a triage, not a lockdown, and the sorting question for every row is "what is the worst thing a poisoned input could make this tool do, and can we undo it?" A deployment review that produces this table has operationalized LLM06 in an afternoon; a policy document that says "the agent follows the principle of least privilege" has not.
The runner-up worth naming so the prioritization looks deliberate: LLM05, improper output handling, agents whose output is rendered as HTML or executed as code reintroduce XSS and command injection through the model. It loses the top-two slot only because the fix is conventional (encode, sandbox, validate) and most teams' existing AppSec instincts cover it.
Then the conditioning that earns senior marks: priorities move with architecture. RAG-heavy deployment with no tools? LLM08 and LLM02 climb, poisoned or permission-leaking retrieval is the live wire. Customer fine-tunes on user-submitted data? LLM04 jumps. Public unauthenticated chatbot? LLM10, unbounded consumption, becomes a cost and denial-of-wallet problem before anything else.
What interviewers probe next
- "Why not sensitive information disclosure as your number one? That's what our CISO asks about.", Disclosure through an agent almost always routes through injection plus over-permissioned access; prioritizing LLM01/LLM06 is treating the cause, and per-user permission enforcement at retrieval handles most of LLM02 as a side effect.
- "How would you test your two priorities before go-live?", Scripted injection corpus against every untrusted input channel, plus an agency audit: enumerate every tool, its credential scope, and its worst-case action; anything irreversible without a human gate fails the review.
- "Which of the ten is most overrated?", Defensible pick: system prompt leakage, if you've followed the rule that prompts contain nothing secret. Saying this shows you treat the list as a thinking tool, not scripture.
Common mistakes
- The full recitation. Five minutes in, you've shown memory and zero judgment, and the interviewer has stopped listening.
- Picking two risks without tying them to the stated deployment ("enterprise agent" was in the question for a reason).
- Treating the list as a compliance checklist, "we mitigate all ten", rather than a prioritization frame. Nobody mitigates all ten equally; pretending otherwise reads as never having shipped.
- Not knowing what changed in 2025: vector/embedding weaknesses, system prompt leakage, and unbounded consumption were the notable additions, and name-checking that signals current knowledge rather than a 2023 blog post.