AI agent interview questions

ReAct is the pattern behind most tool-using agents. The signal is why interleaving reasoning with actions (and observing results) beats reasoning alone or acting alone. Here is the answer that connects the prompt pattern to real agent behavior.

Complex tasks rarely fit one prompt, and free-text LLM output rarely plugs into code cleanly. The signal is decomposing into chained steps and parsing each output. Here is the answer that connects prompting to real pipelines.

Tool calling powers every agent. The signal is knowing the model executes nothing: it emits a structured request your code runs, then you feed the result back. Here is the loop and the details that decide reliability.

The training cutoff is frozen but dependencies move weekly. Retrieve the installed docs and lockfile, let the linter drive a fix loop, and skip retraining.

The per-token sticker price hides the real decision. Self-hosting only wins past a volume break-even most teams misjudge. Here is the back-of-envelope a staff engineer does on the whiteboard.

Generation has to stop somewhere, and the wrong stop rule either truncates answers or burns tokens on trailing garbage. Here is how the EOS token, stop strings, and max-token caps actually interact.

Agents are over-applied. The strong answer resists the hype: most tasks want a single structured call, and agents earn their cost only under specific conditions. Here is when to reach for one and how to stop it from compounding errors.

Agents and integrations live or die on the model returning valid, schema-conforming output. The signal is layering constrained decoding, schema validation, and retries, not hoping a prompt is enough. Here is the production-reliability answer.

Multi-agent is the most over-applied pattern in AI right now. The signal is resisting it unless the task truly needs specialization or parallelism, knowing the supervisor and handoff patterns, and understanding why coordination amplifies failure.

Conversations and agent tasks outgrow the context window, and naive 'stuff the whole history' fails on cost, latency, and lost-in-the-middle. The signal is a tiered memory design: recent buffer, summarized mid-term, retrieved long-term.

MCP standardized how agents plug into tools and data, but tool design is what makes or breaks reliability. The signal is knowing what MCP actually standardizes and the principles behind a tool the model can call correctly from its description alone.

Reflection is the pattern where an agent critiques and revises its own work. The signal is knowing when it genuinely helps (external feedback grounds the critique) versus when self-critique alone is theater.

Plan-and-Execute and ReAct are the two dominant agent control patterns. The signal is knowing the upfront-plan vs step-by-step tradeoff, why one is cheaper, and why most production agents end up blending them.

Agents need memory beyond the context window, and 'just store the history' is the wrong answer. The signal is distinguishing the memory types and mapping each to a storage and retrieval strategy. Here is the answer.

Context engineering is the discipline that replaced 'prompt engineering' for serious agent work. The signal is understanding that what you put in the context window (and what you leave out) drives behavior more than clever wording. Here is the answer.

Code-execution agents are powerful and dangerous: arbitrary model-generated code runs on your infrastructure. The signal is real isolation (containers/VMs), resource limits, and network/filesystem restrictions, not 'trust the model.' Here is the answer.

Tool selection and parameter extraction are where agents quietly fail. The strongest answer treats the tool spec as the only thing the model sees, then fixes the design, not the model. Here is how.

Agents fail in the middle, not just the end, so final-answer-only scoring hides the real problems and rewards lucky paths. The signal is evaluating the whole trajectory and localizing where it broke. Here is the answer.

Sub-agents are how you scale a complex agent task without one giant, noisy context. The signal is context isolation and clean delegation: a focused subtask in, a compact result out. Here is the answer.

Multi-agent systems live or die on how agents share information and hand off work. The signal is naming the three communication patterns and the coordination failures that sink the naive version. Here is the answer.

The same model performs wildly differently depending on the harness around it. The signal is knowing that the scaffolding often decides agent quality more than the base model. Here is the answer.

A computer-use agent drives a real browser or desktop through screenshots and clicks. The signal is the perceive-decide-act loop plus the containment for an agent that can click, buy, or delete anything. Here is the answer.

An agent that takes actions is far riskier than one that just talks. The signal is action-level guardrails: least privilege, argument validation, human approval for irreversible actions, and a blast-radius mindset. Here is the answer.

Forcing every query through the same pipeline burns latency, money, and precision. A router decides what each query actually needs. The signal is naming the four decisions a router makes and how you keep a misroute from sinking the answer.

Standard RAG retrieves once and generates; agentic RAG turns retrieval into an iterative, reasoning-driven loop. The signal is the agent deciding whether, what, and when to retrieve, then re-retrieving until the evidence holds.

At a billion vectors the index choice is a memory budget problem before it's a recall problem. Flat search is out, HNSW may not fit, and PQ trades recall for RAM. Here is the decision a staff engineer makes on the whiteboard.

An agent that retries the same failed action 40 times is a runaway bill and a stuck user. Termination is something you engineer into the harness, not something the model reliably decides. Here is the control layer.

Real tools time out, rate-limit, and return malformed JSON. An agent that assumes every call succeeds is a demo, not a product. Here is the error-handling layer that keeps it alive in production.

Real users type 'what about the new policy?' with no context. Retrieving on those four words returns noise. Here is how strong systems disambiguate before they ever hit the retriever.

When a chain of LLM calls and tools produces a wrong final answer, 'the model was bad' is not a diagnosis. You need to see every step. Here is the tracing layer that turns a black box into something debuggable.

Frameworks promise speed and deliver abstraction you'll eventually fight. Rolling your own is more code but full control. Here is the honest tradeoff, and why many production teams end up thinner than they started.

The industry conflates 'agent' with anything that calls an LLM. The useful distinction is how much control you hand to the model, and more autonomy is not better. Here is the spectrum and the decision rule.

A live-coding round that separates people who have shipped agents from people who have read about them. The signal is a real plan-act-observe loop, tools that hit an actual SQL database, guardrails that stop the obvious failures, and a concrete evaluation plan, not a single prompt that pretends to be an agent.

Linear agents commit to one path and can't backtrack. Tree-of-Thoughts and LATS add search over reasoning paths. The signal is knowing what they buy, what they cost, and when a cheaper loop wins.

A context window is not memory. Real agents need a storage architecture: working buffer, episodic recall, and consolidated facts. The signal is the read/write paths and how you keep memory from rotting.

Tools fail: timeouts, rate limits, bad arguments, garbage output. A naive agent retries blindly or gives up. The signal is classifying errors and matching each to the right recovery, with hard caps.

Multi-agent systems coordinate through handoffs and shared state. The signal is knowing the orchestration topologies, what a clean handoff protocol carries, and why naive multi-agent often loses to one good agent.

Most people know MCP exposes tools. The deeper signal is the full primitive set (resources, prompts, sampling, roots) and the patterns: server composition, sampling for nested LLM calls, and scoping access safely.

Final-answer accuracy hides how an agent got there. The signal is trajectory-level metrics: tool-selection and argument accuracy, step efficiency, and matching against reference paths, plus when exact-match is the wrong yardstick.

Per-step accuracy looks fine, yet a 50-step task fails. The signal is understanding compounding error and the techniques (decomposition, verification, checkpointing) that keep long-horizon agents from collapsing.

Agents can critique and retry their own work. The signal is knowing how Reflexion's verbal feedback loop works, when self-critique genuinely helps versus when it is theater, and what makes it real.

Autonomous agents still need humans at the right moments. The signal is designing checkpoints: where to interrupt, what to surface, how to persist and resume state, without turning the agent into a click-through rubber stamp.

Any content an agent reads can carry instructions that hijack it. The signal is knowing why filtering can't fully solve injection and which containment controls actually bound the damage when it succeeds.

Agents re-send growing context every step, so cost scales worse than linearly. The signal is knowing where the tokens go and the levers (caching, model routing, context trimming, step caps) that cut the bill.

Agents that drive a browser or screen fail in ways chat agents never do: stale DOM, dynamic pages, wrong clicks. The signal is the grounding and reliability techniques that turn a flaky demo into something usable.

One emits a JSON call per turn and round-trips every result through context. The other emits a program run in a sandbox. Cost, latency, and auditability.

Single-turn evals cannot catch failures that history causes, because they have no history. The offline answer is two suites, one deterministic and one simulated, and an honest account of why the simulated user will lie to you about how good your agent is.

The most role-defining judgment call in Applied AI: a shiny benchmark number against the operational price of a system nobody can debug at 2am. Most candidates ship on the number and lose the loop there. Here is the answer that passes.

Every tool definition costs context and adds a wrong option. Past a couple of dozen tools, selection accuracy falls and the fix is choosing a smaller loadout per task, not writing better descriptions.

The modern agentic system-design question. The signal is the plan, search, read, synthesize, verify loop with per-claim citations, plus bounding cost and latency. The hard parts are not the writing.

Cross-session memory is what makes an assistant feel personal, and it is mostly a retrieval and state-management problem, not a bigger context window. The signal is the tiered architecture plus what to store, forget, and protect.

Customer support is the killer applied-AI use case, testing agents, RAG, tools, and the all-important human escalation. The signal is knowing when to resolve, when to act, and when to hand off, safely.

AI code review lives or dies on precision: a few noisy comments and the team mutes the bot forever. The signal is grounding in the diff plus repo context, ruthless false-positive control, and earning developer trust one accepted comment at a time.

Code migration is a high-value agentic task with an unforgiving correctness bar: the migrated code must still work. The signal is grounding in the real repo, transforming in verifiable chunks, and gating on tests, never one giant LLM rewrite.

The trap is replacing the classifier with an LLM. The real-time, imbalance, and adversarial constraints do not go away. The signal is a hybrid: a fast calibrated model scores inline, LLMs investigate the gray zone off the hot path.

A Devin-style agent that turns an issue into a merged PR is the hardest agent to make reliable, because every step can fail and errors compound. Here is the architecture and the loop that keeps it honest.

GPUs are scarce and expensive, so multi-region HA for LLMs is not just web-app HA with bigger boxes. Capacity, routing, and failover all bend around the GPU constraint. Here is the design.

An agent that clicks around a real website is slow, brittle, and one wrong click from a costly mistake. The architecture is about perception, action, and guardrails around irreversible steps. Here is how to build it.

'What was revenue by region last quarter?' sounds like text-to-SQL, but production analytics agents fail on ambiguity, wrong joins, and confidently wrong numbers. Here is the architecture that makes the answers trustworthy.

Auto-resolving support tickets means grounding answers in your knowledge base, safely calling real APIs (refunds, account changes), and knowing when to hand off to a human. Learn the agent loop, the guardrails, and how to measure resolution without breaking trust.

Long-running agents that loop, call tools, and spawn sub-tasks need durable execution, not a single request handler. Learn how to checkpoint state, recover from failures, bound runaway loops, and observe every step a non-deterministic agent takes.

ML workflows are multi-step DAGs (ingest, feature, train, eval, deploy), and orchestrators run them reliably. The signal is the DAG/scheduling model plus what's actually ML-specific: data deps, versioned artifacts, drift triggers, eval gates.

Anyone can wire tasks into a DAG. The signal is the patterns that keep it correct under retries and backfills: idempotency, data-aware triggering, and the asset model. Here is what separates a flaky pipeline from a trustworthy one.

These four get conflated constantly, but they live at different layers: data processing, distributed training, and general orchestration. The signal is matching the tool to the workload instead of reaching for the one you know. Here is the answer.

Launching an LLM service on a vibes-based GPU count is how you get paged on day one. Capacity planning for LLMs differs from web services because tokens, not requests, are the unit. Here is how to size it.

When every request thinks for 30,000 tokens, serving flips from compute-bound prefill to memory-bound decode, and the KV cache becomes the resource you actually schedule. The levers that ruled chat traffic stop being the ones that matter.

Prompt injection has no single fix, and 'sanitize the input' fails the round. The signal is defense in depth: privilege boundaries, treating retrieved content as data not instructions, and a human gate on irreversible actions. Here is the layered answer.

Direct injection is the user attacking the prompt. Indirect injection hides the attack inside a page, doc, or email the model reads. The signal is realizing retrieved and tool data is untrusted and can hijack the model. Here is the answer.

When an agent holds private data, reads untrusted text, and can communicate out, injected instructions can steal data. This 'lethal trifecta' is the defining agent vulnerability. The fix is architectural, not a better prompt.

An agent that trusts its tools and its own memory can be steered by a single poisoned record that resurfaces turns or sessions later. The signal is seeing persistent state as an attack surface, not just the live prompt.

A hijacked agent does not need a 'send email' tool to leak secrets. A rendered markdown image, a URL parameter, or a DNS lookup is enough. The signal is enumerating the covert channels and locking down egress, not just tools.

An agent running on one over-privileged service account is a confused deputy waiting to happen. The signal is per-user delegated credentials, token exchange, per-tool scopes, and an audit trail that names the human. Here is the answer.

Approval happens once, at install. The tool description is fetched every session and goes straight into the model's context, so a server that behaves for a week and then rewrites a description has a live injection channel you already trusted.

Once agents multiply inside a company, the missing piece is not a better agent, it is a single place every agent's traffic passes through and a single place every agent and tool is registered.