Agentic AI interview questions and answers for 2027

Agentic AI interview questions for 2027 fall into six topics: agent basics, tool calling and MCP, memory and RAG, multi-agent patterns, evaluation and safety, and system design. The sections below give 17 questions with model answers drawn from Anthropic, OpenAI, Microsoft, OWASP and the original ReAct and RAG papers, so a candidate can check every claim against a primary source before an interview.

What do agentic AI interviews usually test?

Job postings name these topics. Cursor's India forward deployed engineer posting asks for ownership of tracing, evals, metrics, latency and cost trade-offs. Anthropic's forward deployed engineer posting lists MCP servers, sub-agents and agent skills. Bloomberry's analysis of about 1,000 forward deployed engineer postings, mostly from the United States, found AI agents named in 35% of them.

The table maps each topic to what an interviewer is checking and the evidence worth bringing.

Agent basics

What is the difference between an LLM, a workflow and an agent?

A single LLM call turns one prompt into one response. A workflow orchestrates LLM calls and tools through predefined code paths. An agent is a system where the LLM dynamically directs its own process and tool use. Anthropic draws that workflow-versus-agent line, and OpenAI adds that simple chatbots, single-turn LLMs and classifiers are not agents, because the model does not control workflow execution.

When should you not build an agent?

When one LLM call or a fixed workflow meets the requirement. Anthropic recommends the simplest solution possible and notes that agentic systems often trade latency and cost for better task performance. Microsoft's guidance says to use the lowest level of complexity that reliably works, and calls a single agent with tools often the right default.

How does an agent loop work, and when must it stop?

The loop sends the conversation and tool list to the model, runs any tool the model requests, appends the result and repeats until the model answers without a tool call. It also needs a limit. OpenAI lists a maximum number of turns among exit conditions, and Microsoft advises iteration limits against infinite tool-call loops. The sketch below uses a stub model.

TOOLS = {"get_order": lambda order_id: f"order {order_id} delivered"}


def fake_model(messages):
    """Stand-in for an LLM: asks for one tool, then answers."""
    if messages[-1]["role"] == "tool":
        return {"type": "final", "text": "Status: " + messages[-1]["content"]}
    return {"type": "tool_call", "name": "get_order", "args": {"order_id": 42}}


def run_agent(user_text, model, max_steps=5):
    messages = [{"role": "user", "content": user_text}]
    for step in range(1, max_steps + 1):
        reply = model(messages)
        if reply["type"] == "final":
            return reply["text"], step
        result = TOOLS[reply["name"]](**reply["args"])
        messages.append({"role": "tool", "content": result})
    return "stopped: step limit reached", max_steps


print(run_agent("Where is my order?", fake_model))
never_done = lambda m: {"type": "tool_call", "name": "get_order", "args": {"order_id": 1}}
print(run_agent("Loop forever", never_done, max_steps=3))

Output from running it with Python 3.9:

('Status: order 42 delivered', 2)
('stopped: step limit reached', 3)

The reason-act-observe shape comes from the ReAct paper (Yao and others, 2022), which interleaves reasoning traces with actions and reported absolute success-rate gains of 34% on ALFWorld and 10% on WebShop over imitation and reinforcement learning methods.

Tool calling and MCP

How does tool calling work?

The application sends the model a list of tools with JSON schemas, and the model replies with a tool call naming a tool and its arguments. The application runs the code, returns the output, and the model either answers or requests another tool. Anthropic's docs stress that the model never runs anything on its own, so permission checks belong in the application.

How do you design a good tool?

Anthropic's guidance lists five habits: choose the right tools, namespace them clearly, return meaningful context to the agent, keep responses token-efficient and write tool descriptions as carefully as prompts. It then says to measure tools with an evaluation. A strong answer adds that a tool should do one narrow job, because OWASP warns against open-ended tools such as a general shell command.

What is MCP and how does it differ from function calling?

The Model Context Protocol is an open standard for connecting AI applications to external systems through servers that expose tools, resources and prompts. Function calling is how a model requests a tool run. A host uses MCP to fetch tool definitions and routes the model's calls to the right server. MCP does not dictate how an application uses the LLM.

Memory and RAG

What is the difference between short-term and long-term memory in an agent?

LangChain's documentation defines short-term memory as thread-scoped state, mainly conversation history, saved with a checkpointer so a thread can resume. Long-term memory stores user-specific or application-level data across sessions and threads, in stores organised by namespace. A good answer adds that long-term memory needs rules for what to save, update and delete.

What is RAG, and when would you skip it?

Retrieval-augmented generation retrieves relevant information from a knowledge base and appends it to the prompt. The 2020 paper by Lewis and colleagues paired a model's own memory with a dense vector index of Wikipedia. Skip it for small corpora: Anthropic notes that a knowledge base under 200,000 tokens, about 500 pages, can go straight into the prompt, with prompt caching making that faster and cheaper.

How do you improve retrieval quality?

Measure first, using test questions with known source passages. Then try changes such as the ones in Anthropic's Contextual Retrieval write-up, where contextual embeddings plus contextual BM25 reduced failed retrievals by 49% and by 67% with reranking on Anthropic's tests. Those are one vendor's results, so a candidate should say the changes need re-measuring on their own data.

Multi-agent patterns

Which multi-agent patterns exist, and when does each fit?

Microsoft's Azure guidance names sequential, concurrent, group chat, handoff and magentic orchestration. OpenAI's SDK docs contrast agents as tools, where a manager keeps control, with handoffs, where a specialist takes over. Anthropic's list adds routing, parallelization, orchestrator-workers and evaluator-optimizer. Tie each to a trigger: parallel workers suit independent sub-questions, and handoffs suit routing. The multi-agent systems guide goes deeper.

What are the risks of multi-agent systems?

Cost, coordination and consistency. Anthropic reported that its multi-agent systems used about 15x more tokens than chats. Cognition argues that agents working on parts of a task without shared context make conflicting decisions. A 2025 study of 7 frameworks and 1600+ annotated traces grouped failures into 14 modes in 3 categories. The safe answer starts with a single-agent baseline.

Evaluation and safety

How do you evaluate an AI agent?

Define tasks with success criteria, run several trials of each because outputs vary, and grade with code-based checks where possible, model-based graders for open-ended output and humans to calibrate them. Anthropic separates the transcript from the outcome: a booking agent saying it booked a flight matters less than whether a reservation exists in the database. Keep capability evals apart from regression evals, which should stay near a full pass rate.

What do pass@k and pass^k measure?

pass@k is the chance of at least one correct result in k attempts, so it rises as k grows. pass^k is the chance that all k trials succeed, so it falls as k grows. Anthropic's example: an agent that succeeds 75% of the time per trial passes three trials in a row about 42% of the time. Customer-facing agents need the stricter view.

How do you stop an agent from taking unsafe actions?

Layer the controls. OWASP's Excessive Agency entry (LLM06:2025) names excessive functionality, permissions and autonomy as root causes and recommends fewer and narrower tools, minimum permissions, execution in the user's context, human approval for high-impact actions and authorisation enforced in downstream systems rather than by the model. OpenAI adds rating each tool low, medium or high risk and escalating high-risk calls to a person.

What is indirect prompt injection?

It happens when an LLM accepts input from external sources, such as websites or files, that carries instructions which change its behaviour. OWASP lists prompt injection as LLM01:2025 and says RAG and fine-tuning do not fully mitigate it. The structural defence is limiting what a hijacked agent can do: narrow tools, read-only access where possible and approval for writes.

System design

How would you design a refund assistant for an online store?

A hypothetical answer: a read-only order lookup tool, a refund tool rated high risk that waits for human approval, the refund policy retrieved as context, a step limit, a trace of every tool call and a regression set built from past tickets. Approval maps to LangGraph's interrupt or the OpenAI Agents SDK's needs_approval, and Microsoft advises saving state outside memory so runs can resume.

How do you keep an agent's cost and latency under control?

Start with the biggest multipliers. Anthropic's data put agents at about 4x the tokens of chat and multi-agent systems at about 15x. Route easy requests to smaller models, a pattern Anthropic describes under routing, cap the steps and compact context by summarising or pruning, as Microsoft advises. State the trade-off: agentic systems often exchange latency and cost for better task performance.

What are the limits of memorised answers?

Vendor guidance ages quickly. Anthropic's Building effective agents essay, dated 19 December 2024, now notes that much of the tooling it describes has changed, and the MCP specification has moved to its 2026-07-28 revision. The percentages above are each vendor's own results on its own tests.

Interviewers also probe projects more than definitions. Sarvam's Agent Engineer posting says that having shipped something real users depended on matters more than years of experience. The agentic AI roadmap pairs each stage with a project that can carry that conversation.

Where does interview preparation fit in the FDE Cohort?

The Forward Deployed Engineer (FDE) Cohort is a Leap by Masai programme for engineers with hands-on technical experience, run as an in-person start in Goa, an online build phase and an in-person hackathon in Bangalore for qualifying participants, covering production Python, APIs, cloud deployment, LLMs, retrieval, agents, security and client engagement. Its curriculum includes a block on retrieval and agents and another on security, monitoring and cost, the topics behind the questions above.

Frequently asked questions

What topics do agentic AI interviews cover?

Agentic AI interviews usually cover agent basics, tool calling and MCP, memory and RAG, multi-agent patterns, evaluation and safety, and system design. Postings from Anthropic and Cursor name MCP servers, sub-agents, tracing, evals and cost trade-offs, so candidates should prepare one worked example for each topic rather than only definitions.

How do you evaluate an AI agent in an interview answer?

Describe tasks with clear success criteria, several trials per task, and graders: code-based checks first, model-based graders for open-ended output and humans for calibration. Then mention regression evals that protect earlier behaviour and pass^k for consistency. Anthropic's January 2026 guidance on agent evals uses these terms.

How do you stop an agent from taking unsafe actions?

Limit what the agent can do, then add approval. OWASP recommends fewer and narrower tools, minimum permissions and human approval for high-impact actions, with authorisation enforced in downstream systems. OpenAI suggests rating each tool by risk and pausing or escalating high-risk calls. Logging and rate limiting reduce damage when something slips through.

Do interviews expect a specific framework such as LangGraph?

Usually not. Postings tend to name skills: Anthropic's forward deployed engineer posting lists MCP servers, sub-agents and agent skills, and Sarvam's Agent Engineer posting lists context engineering, tool use, structured outputs, memory and evals. Bloomberry's postings sample found Python in 66% and AI agents in 35%. One framework used well is enough.

Which project best proves agentic AI skills in an interview?

A small agent with two or three typed tools, one approval step for a risky action, a test set of real cases and a trace of each run. That single project shows tool design, safety and evaluation. Sarvam's posting values shipped work that real users depended on, so deploying even a small project helps.

Next step

Choose three questions from each topic, answer them aloud and check every claim against the source named in the answer. The Forward Deployed Engineer (FDE) Cohort page lists the curriculum on retrieval, agents and production deployment for engineers who want to practise these topics on a real system.