GO TO A SECTION

↑ ↓ to navigate · Enter to openExplore all sections →
FDEInterviews logo
← AI Security, Privacy & Governance / 36
hardAnthropicMicrosoftSalesforce

Threat-model a multi-agent system where agents call each other. Where are the trust boundaries and how does one compromise spread?

When agents call agents, one agent's output is another's untrusted input, and a single injected instruction can propagate across the whole graph with accumulated privileges. The strong answer treats every inter-agent edge as a trust boundary and bounds privilege per agent, not per system.

Updated Aug 2026 · Grounded in real Forward Deployed Engineer interview loops and written to a senior-engineer editorial bar.

When agents call agents, one agent's output is another's untrusted input, and a single injected instruction can propagate across the whole graph with accumulated privileges. The strong answer treats every inter-agent edge as a trust boundary and bounds privilege per agent, not per system.

20 answers per topic instead of 10, plus saved progress and bookmarks · no cardor unlock all 548 remaining answers · ₹2,000 / $25

Every answer, concept and course, every paper breakdown, all published video lessons, hands-on FDE Lab missions, Premium PDF guides and companion files, the full practice-test bank and work-sample downloads. Referral Premium excludes guide PDFs and their companion files.

6 months · One payment · No auto-renewal

Study alongside free video lessons.

Keep practising

Next in this trackDesign a fully on-premise diarization and summarization pipeline for sensitive meeting recordings that provably does not retain transcriptsPremiumNext in this trackReproduce-from-paper: design a production-safe Constitutional-AI-style fine-tuning pipeline that aligns a chatbot to a set of rulesPremiumNext in this trackSet up a red-teaming evaluation framework for a code-generation model that sometimes emits malicious scriptsPremium
FEDITOR'S NOTE

The trap is treating the multi-agent system as one trusted unit, because the dangerous property is exactly that agents trust each other's output by default, so an injection in one propagates with the union of privileges along the call path. The senior move is per-agent least privilege plus treating inter-agent messages as untrusted content, which contains the blast radius to one agent's scope. Watch for the candidate who gives a single orchestrator a god token that every sub-agent effectively borrows, which collapses all the boundaries at once.

DISCUSSION · 0

No comments yet — be the first to share your approach.