AI engineer interviews
AI agent interview questions and answers
An agent is a language model that can call tools and decide its next step by itself. Interviewers want to know if you can make one safe and reliable: what it may do, when it must stop, and what happens when a tool fails halfway.
What they test
What interviewers look for.
- You know when not to use an agent. A fixed chain of steps is cheaper and easier to test when the path is always the same.
- You set limits: a cap on steps, time and spend, so a confused agent stops.
- You make actions safe to repeat. A retry must never send the same refund or email twice.
- You keep a person in the loop for actions that cannot be undone.
- You log every step: what the model saw, which tool it called and what came back. Without that you cannot debug it.
- You test the agent on whole tasks, not just single replies.
Questions
Agent design questions.
You design an agent for a real job. Start with what it is allowed to do, then the tools, then the limits.
A worker sends an approval request and crashes before the user responds. What design would ensure the approval request is not lost and can be recovered after a restart?
A good answer covers: Persisting approval requests before sending; Idempotency of approval handling on restart; Recovery scan for pending approvals after crash.
An agent asks an external service to create a support ticket. Its request times out, the UI reports uncertainty, and a success callback may arrive later. The service accepts an idempotency key and offers a status lookup. Design the local state transitions so retries and late callbacks converge on one ticket without claiming a timeout proves failure.
A good answer covers: Represent timeout as an unknown outcome when an external side effect may have committed; Reuse a stable operation key across retries and reconcile callbacks with authoritative status; Apply idempotent guarded state transitions so late or duplicate results cannot create contradictory outcomes.
Design an assistant that looks up orders and proposes refunds. Users may approve eligible refunds, but a retry must never issue the same refund twice. Describe the execution boundary.
A good answer covers: separate model proposals from server-enforced authorization and policy; bind confirmation to exact action arguments; use durable idempotency and reconcile ambiguous payment outcomes.
An agent planner is limited to a maximum number of reasoning steps. It often spends all steps on subgoal exploration and never reaches the decisive lookup required to answer the user's question. What concrete design change would you make to avoid this failure?
A good answer covers: prioritizing critical actions in planning; budgeting steps for essential operations; monitoring plan progress to preempt dead ends.
An agent executes a multi-step plan, but the user corrects one intermediate step (e.g., updates a parameter). How should the system design allow partial replanning to efficiently update only the affected steps, while ensuring overall plan validity?
A good answer covers: Track plan dependencies to identify affected steps; Enable incremental replanning from the correction point; Verify consistency and validity of the updated subplan.
An agent system queues user-approved actions for later execution. Approvals may expire before execution. What design ensures only valid approvals are used?
A good answer covers: approval validity must be rechecked before execution; track approval expiration timestamps with jobs; handle jobs with expired approvals safely.
A company approves an MCP integration after reviewing its available tools. The remote server can subsequently add tools or change descriptions and schemas. Design a process for handling those changes without silently widening access.
A good answer covers: bind approval to a trusted integration identity and a reviewed set of capabilities or tool definitions; detect meaningful capability changes and require policy evaluation before making expanded actions available; keep resource permissions and execution-time checks independent of descriptions and record which definition was used.
Design a research agent that can search and inspect documents to answer a question within 30 seconds and a fixed spend. How would you control planning and decide when it has enough evidence?
A good answer covers: bound tool calls concurrency time and spend outside the model; track evidence provenance and conflicting sources in structured state; define stopping and insufficient-evidence outcomes and evaluate task success.
Your agent’s error handler currently treats all tool errors the same, retrying even for permanent failures like validation errors. What concrete changes would you make to distinguish between retryable and permanent errors, and how would you verify the distinction is robust?
A good answer covers: Error classification based on error codes or types; Separate handling for retryable vs permanent errors; Integration tests simulating both error types.
An agent submits a payment request with an idempotency key. On network failure, it retries with a new key. What risks does this pose, and how would you design the retry logic to avoid duplicate payments?
A good answer covers: idempotency key reuse for retries; risk of duplicate action on unique key; external system's interpretation of idempotency keys.
An assistant generates Python to analyze user-uploaded CSV files. Design the execution boundary so a malicious file or generated program cannot read service credentials, contact arbitrary hosts or monopolize the worker.
A good answer covers: treat generated code and uploaded data as untrusted and isolate execution from the application process and its credentials; restrict filesystem access and network egress and enforce CPU, memory, process and wall-time limits; test escape and exfiltration attempts and clean up per-run state while preserving bounded diagnostic output.
Your agent receives tool responses that may contain embedded instructions (e.g., 'reset password') disguised as data fields. Under strict security and correctness constraints, how would you design the system to detect and block such cases, and how would you verify your approach?
A good answer covers: Detecting control instructions within data fields; Implementing validation or sanitization to block unsafe content; Verifying detection with adversarial or fuzzed inputs.
Questions
Agent debugging questions.
Each one starts with an agent that misbehaves. Name the likely causes and how you would confirm one.
Your agent tool is supposed to only read files from a designated workspace directory, but logs show it sometimes accesses files outside this path. What steps would you take to isolate the root cause and prevent future escapes?
A good answer covers: Path normalization before access; Validation against the workspace root; Audit of user-supplied or model-generated paths.
A durable agent workflow resumes after a crash and re-executes a read step that already finished, causing duplicate reads. How would you isolate whether this is due to missing or incorrect persisted state?
A good answer covers: Inspect persisted workflow checkpoint for step completion markers; Compare step execution logs with checkpoint restoration logic; Check idempotency and replay handling in the workflow framework.
An agent checks user approval for a file deletion, then waits for a plan step to finish. When it finally deletes the file, the user's approval may have been revoked. How would you diagnose and prevent this authorization gap?
A good answer covers: risk of stale approval between check and use; revalidating authorization at action time; identifying time-of-check/time-of-use mismatch.
Two agent instances process the same workflow task concurrently and sometimes overwrite each other's updates to the shared task record. How would you diagnose and isolate the cause?
A good answer covers: Check for missing concurrency controls on task record writes; Compare timestamps or versions of conflicting updates; Examine agent logic for duplicate or parallel task assignment.
You observe an agent planner executing dependent tool calls (e.g., search then summarize) as if they are independent, resulting in summaries of irrelevant or incomplete data. How would you isolate the cause of this failure?
A good answer covers: tracing data flow between tool outputs and inputs; inspecting the plan's dependency graph; verifying correct sequencing of tool invocations.
An MCP client automatically approves any tool whose server advertises readOnlyHint=true. A newly connected server claims that hint for a tool that exports internal records. How would you assess and correct the approval policy?
A good answer covers: treat server-supplied annotations as descriptive hints rather than independent authorization; apply a trusted client or gateway policy based on identity, allowed resources and action sensitivity; test an untrusted server that mislabels a tool and audit what data the approved action can disclose.
A planner emits tool calls using schema version v2, but the executor expects v1. Some requests fail unexpectedly. How would you diagnose and confirm this specific schema version mismatch as the root cause?
A good answer covers: Tracing the schema version used by planner and executor; Comparing request/response formats for version-specific fields; Reproducing or inspecting failures with versioned payloads.
An agent planner repeatedly generates variations of the same search query, retrieving similar documents each time and failing to discover relevant but differently phrased evidence. What concrete steps would you take to diagnose and resolve why exploration is trapped in this narrow query family?
A good answer covers: Inspect query generation logic for lack of diversity or randomness; Trace planning state transitions to see if prior results influence new queries; Check if the agent’s scoring or memory mechanism overweights recent queries.
An agent runs a batch action on 100 items. Some succeed, some fail. The system can't tell which items were affected. How would you diagnose and reconcile the outcomes?
A good answer covers: need for per-item outcome tracking; idempotency or safe retry for uncertain items; external audit or verification of item state.
A client sends a token issued for an MCP server. The server forwards that same token to an unrelated downstream API because both services recognize the issuer. What must be checked, and how should delegated access work?
A good answer covers: distinguish a valid issuer or signature from authorization for the intended token audience; reject audience-inappropriate tokens and obtain downstream credentials with the proper audience and scopes; preserve user delegation and consent without forwarding arbitrary caller tokens through the server.
A planning agent decomposes a user goal with a strict constraint (e.g., total spend ≤ $1000). The generated subgoals, when combined, exceed the allowed budget, though each subgoal alone appears valid. How would you diagnose and verify this class of failure?
A good answer covers: representing cumulative constraints during decomposition; detecting constraint violations due to subgoal interactions; tracing constraint propagation across subgoal boundaries.
A workflow agent displays a confirmation summary before executing changes. Some users approve actions with the wrong payment amount because the summary omits this field only when the amount is set asynchronously. How would you isolate and verify the cause of this omission?
A good answer covers: trace timing of field population vs. summary rendering; inspect async data enrichment and race conditions; verify summary template logic for dynamic fields.
How to answer
A simple way to answer agent questions.
- Set the job and the limits
Say what the agent must do, what it must never do, and the budget in steps, time and money.
- List the tools
For each tool, say what goes in, what comes out and what can fail. Mark the ones that change real data.
- Plan for failure
Say what happens on a timeout, a bad tool result or a loop. Add retries that are safe to repeat and a clear way to stop.
- Say how you would test it
Describe a set of full tasks with known good results, and what you would track in production.
Questions.
What is the difference between an agent and an LLM chain?
In a chain, your code decides the steps and the model fills them in. In an agent, the model picks the next step and the tool to call. Agents handle open tasks better, but they cost more, run slower and are harder to test.
What agent topics come up most in interviews?
Tool design, stopping rules, retries that do not repeat an action, human approval for risky steps, memory, cost limits and how to test a full task.
Do I need to know a specific agent framework?
Usually not. Interviewers care more that you can explain the loop itself: the model reads the state, picks a tool, gets the result and decides again. Know one framework well enough to talk about its limits.
Can I practice these questions with Orin?
Yes. The AI Engineer mock interview asks questions like these by voice, with follow-ups based on what you say. You also fix real code in a live editor. After it you get a report with quotes from your answers and what to practice next. Your first interview is free.
Practice agent questions with follow-ups.
An AI engineer mock interview by voice, with real code to fix and a system to design. First interview free.
Start free interview