Set up a red-teaming evaluation framework for a code-generation model that sometimes emits malicious scripts

The screen is whether the candidate builds a measurable closed loop rather than a one-off manual red-team. Senior signals: automated adversarial prompt generation (templates plus an attacker model), output scanning that combines static signatures with sandboxed behavioral analysis, and mitigations at the right layers (a safety classifier and constrained decoding, not just a system-prompt plea). Watch for the candidate who proposes a keyword blocklist on the prompt, which is trivially bypassed and ignores that the danger is in the generated code, not the request wording.