When the Resume Fights Back: Prompt Injection Comes for AI Hiring.

I came across a story recently about a very interesting use of prompt injection. For those not familiar with the term: OWASP ranks prompt injection as the #1 security risk for LLM applications; it happens when input to an AI model alters the model's behavior in ways the builder never intended. The input doesn't even have to be visible to a human, as long as the model parses it. For those coming from cybersecurity, it's in the same family as SQL injection: untrusted input sneaking into the instruction channel. What caught my eye is where it's showing up now: job applicants using it to get around companies' AI resume screeners. I'll share my opinion at the end, but first, the story.

The story: hidden instructions in resumes

Researchers from Duke, Arizona State, UC Berkeley, and UNC-Chapel Hill, working with the hiring platform hireEZ, ran the first systematic study of prompt injection in a widely used real-world AI application. They examined 200,000 real, de-identified resumes spanning July 2019 to December 2025. They found that about 1% contained prompt injection — hidden commands like instructions to mark the resume as qualified, or invisible keywords blended into the background. The rate held fairly stable across industries, but it has climbed sharply since ChatGPT's release — rising sevenfold between July 2024 and November 2025. The study will be presented at the USENIX Security Symposium in August.

One important nuance: the researchers counted attempts, not wins. They deliberately didn't test whether any injection actually changed a hiring decision. Duke professor Neil Gong notes that a few years ago these attacks would have worked completely, because early models obeyed whatever instructions they found.

Industry numbers tell the same story from the employer side. ManpowerGroup, the largest staffing firm in the US, told The New York Times it detects hidden text in roughly 100,000 resumes a year — about 10% of the resumes it scans with AI — while Greenhouse, which processes around 300 million resumes annually, found about 1% with white-text messages. And it's gotten personal: a Stanford postdoc hiring a lab technician recently went viral after finding 2.25-point white-font commands in applications, instructing the AI screener to advance the candidate.

The researchers also point out this goes well beyond hiring. Prompt injection is a growing risk for agentic AI — systems that perform multi-step tasks, retrieve information from the internet, and store memory. The more sources a system draws input from, the more opportunities for hidden malicious instructions to ride in.

My take

When I was preparing for my CISSP, SQL injection was an important topic. So much of the web is a front end talking to a database, and those databases are deterministic — if this input comes in like this, it means this. Without the right guardrails, it was easy to trick a website into giving up more than it should, because it's a "dumb" system in that sense: it does exactly what the input says. With the evolution of AI came prompt injection, and here's the part that matters: an LLM is not deterministic. It's probabilistic — the same prompt can produce different outputs depending on settings like temperature. With SQL injection, we eventually got a clean fix: parameterized queries that strictly separate code from data. With LLMs, there is no equivalent hard separation; instructions and data travel in the same channel, which is exactly why hidden text in a resume can reach the model as if it were a command.

If you spend any time on LinkedIn or other social media, you'll notice the number of people, especially in tech, sliding into the comments about not getting callbacks. Some of that is the job market and the economy. But as I wrote in my first blog post, companies are using AI to screen people, and plaintiffs in the Workday case allege many were rejected for things they couldn't change. A lot of people are turning to these tricks not to cheat, exactly, but to get in front of a hiring manager instead of being screened out automatically over a keyword or an error. If the AI screening system can't be trusted, the subject of my last post- I can see why people look for ways around it.

The AI screener helps companies move faster and, in theory, get the right people in front of the hiring manager. But as a security professional, two obligations come with deploying one. First, guardrails in the AI itself to combat manipulation treat resume content as untrusted input, because that's what it is. Second, clean up the data behind it. A lot of AI is built on data carrying systemic bias, and the data doesn't know right from wrong; it's nothing more than a math equation following the paths it was given. Data quality isn't a side issue; it's the whole ballgame.

Here's my prediction: we'll see companies try to profit off this, websites promising "75% chance of getting in front of the hiring manager with this template", and we'll see more sophisticated evolutions of prompt injection in resumes and cover letters to stay ahead of detection, an arms race. Which is exactly why the companies deploying AI screeners have to do a better job with governance: understand the data, understand what's happening behind the model, and keep a human in the loop. That's one of the big principles in the AAISM, and it's the right one: decisions about people need to be made by people. AI is there to help humans achieve a goal faster. We shouldn't rely on it to do the whole job itself.

Sources