In a tightening job market, a growing fraction of applicants may be trying to game AI-based résumé screening. New research presented as a large-scale security analysis suggests that this is not an isolated quirk of user behavior, but a measurable, accelerating threat: prompt injection.
The study, led by Duke University and collaborators, analyzes real résumés submitted to hireEZ, a widely used hiring platform. Researchers examined 200,000 de-identified documents spanning July 2019 to December 2025, making this the first systematic look at prompt injection in a real-world, deployed AI application.
Prompt injection works by hiding adversarial instructions inside ordinary text. The malicious commands are often embedded through subtle formatting, invisible keywords, or wording designed to blend into résumé content. In early large language models, such hidden directives could be followed, effectively hijacking the screening logic.
The team found that at least 1% of randomly selected résumés contained injection-like instructions. This rate was broadly stable across industries, indicating the tactic is not confined to a single sector or user community. Instead, the same attack pattern appears repeatedly across different résumé styles and domains.
The most striking change came after ChatGPT’s release in 2022. The number of suspect résumés rose sharply, with researchers reporting a sevenfold increase between July 2024 and November 2025. They attribute the acceleration to publicly available tutorials, templates, and short-form videos that simplify injection crafting.
Although the work does not prove that the injected instructions successfully altered hiring outcomes, the volume alone signals risk. The researchers also note that malicious intent may not be guaranteed; some applicants may have unknowingly reused templates containing hidden text. Still, the presence of adversarial inputs undermines trust in automated “go/no-go” screening.
Beyond hiring, prompt injection is a cybersecurity vulnerability that affects agentic AI—systems that can retrieve information, use tools, and combine multiple sources into a single prompt. When any input comes from an untrusted origin, it can steer the system away from its original objective, potentially leading to incorrect decisions.
To counter this, the authors emphasize layered defenses rather than a single fix. Approaches include training models for robustness, monitoring inputs at runtime, and using detection methods to identify where malicious instructions are embedded within otherwise legitimate text.
This research will be presented at the USENIX Security Symposium in August as part of a broader push to secure AI-mediated decision systems. The message is clear: as AI becomes embedded in employment and high-stakes workflows, prompt injection deserves the same seriousness as other real-world attack vectors.
Subject of Research: Prompt injection in LLM-based résumé screening
Article Title: Measuring Real-World Prompt Injection Attacks in LLM-based Resume Screening
News Publication Date: August (USENIX Security Symposium 2026)
Web References: https://arxiv.org/abs/2605.28999
References: Mohan Zhang, Yuqi Jia, Zhen Tan, Steven Jiang, Neil Zhenqiang Gong, Tianlong Chen, Dawn Song. USENIX Security Symposium 2026
Image Credits: Not provided
Keywords: prompt injection, AI hiring, résumé screening, LLM security, agentic AI, adversarial inputs, cybersecurity, runtime detection
