10/14/2026
What if the résumé tells your AI to hire its owner? 👀
You ask AI to rank applicants.
One résumé includes instructions designed to influence the AI's recommendation.
Suddenly, "best candidate" could mean "best at manipulating the tool."
This is called indirect prompt injection. OWASP describes a résumé attack scenario exactly like this. It doesn't mean every hiring tool is vulnerable.
The same risk shows up in vendor proposals and customer messages. Anything written by someone who benefits from the outcome.
Before acting on an AI recommendation, ask: could the author of this document have been talking to the AI instead of to me?
The document you're reviewing shouldn't get to write the rules.
Is your team using AI to screen anything from outside the company yet?