Your Resume Is Also a Prompt: Why Prompt Injection Is the Defining Security Problem in Real-World LLM Systems
The most dangerous misunderstanding in enterprise AI is treating documents , connects it to broader attack surfaces, and argues that interface design is now security design.
The architectural truth
Any time an LLM reads untrusted content, the boundary between "content" and "control" starts to blur
A 2025 RecSysHR paper studied resumes containing hidden adversarial instructions designed to make an LLM overrate a candidate. The authors report seeing real examples in which job seekers hid manipulative text in very small white font, and they evaluated defenses across 1,200 experiments, spanning 10 injection strings, 5 models, and 24 prompting and defense setups. That paper is nominally about hiring. It is not really about hiring. It is about a much bigger architectural truth: when an LLM reads untrusted content, the channel that carries data and the channel that carries instructions become the same channel. NIST explicitly describes this in retrieval systems, noting that LLM use h," which enables indirect prompt injection attacks. This is the core issue. Not resumes. Not HR. The issue is that language h, it processes both the visible qualifications and the hidden instructions.
- NIST framing
Standards: NIST AI 100-2e2025 explicitly notes that LLM use in retrieval h," enabling indirect prompt injection. This is an architectural property, not a bug. - OWASP LLM01
Top risk: Prompt injection sits at the top of the OWASP GenAI risk list. The attack involves crafted inputs that manipulate model behavior, bypass safeguards, or trigger unintended actions.
| Metric | Value | Notes |
|---|---|---|
| Experiments | 1,200 | Defense evaluations across 10 injection strings, 5 models, 24 prompting setups (RecSysHR 2025). |
| Jailbreak range | 0.8% → 52% | Success rates varied dramatically across models and mitigation strategies. |
| Core vulnerability | Blurred channels | Data and instruction channels collapse into one when LLMs process untrusted text. |
Evolving threat landscape
Prompt injection is no longer a niche topic for red-teamers
Microsoft frames indirect prompt injection in practical enterprise terms: it happens when an LLM processes untrusted data and mistakes attacker-controlled content for instructions. Their July 2025 guidance describes this , including input isolation, detection, and impact mitigation. OpenAI h," and in agentic systems the goal is not merely to detect every malicious input, but to constrain the impact even when manipulation attempts succeed. This shift in framing is it is a property to manage.
- Three security layers
Layers: Security lives in the model, in the architecture, and in interface design. Relying only on the model layer is insufficient. - Future systems
Future: The best LLM systems will distinguish themselves not by reasoning ability alone, but by how well they control who influences that reasoning.
Primary sources
References
These references span the academic research, industry guidance, and standards that inform this analysis. They represent the current state of understanding on prompt injection ](https://ceur-ws.org/Vol-4046/RecSysHR2025-paper_9.pdf) — The foundational empirical study with 1,200 experiments across 5 models and 24 defense setups. Demonstrates dramatic variation in jailbreak success rates (0.8% to 52.1%) and the effectiveness of untrusted-tag + guardrail configurations.
- LLM01:2025 Prompt Injection — OWASP's top-ranked GenAI risk, describing prompt injection , bypass safeguards, or trigger unintended actions.
- Adversarial Machine Learning: A Taxonomy and Terminology of Attacks and Mitigations — NIST's comprehensive taxonomy, explicitly discussing how LLM use in retrieval h](https://arxiv.org/abs/2403.14720) — Proposes provenance-signaling transformations to distinguish trusted from untrusted sources. Reduced attack success from >50% to <2% with minimal task impact.
- System-Level Defense against Indirect Prompt Injection Attacks: An Information Flow Control Perspective — Argues for separating planning and execution, filtering untrusted input before it influences high-trust planning, and reasoning about security at the system level.
- INJECAGENT: Benchmarking Indirect Prompt Injections in Tool-Integrated LLM Agents — 1,054 test cases spanning 17 user tools and 62 attacker tools. GPT-4 with ReAct prompting compromised 24% of the time.
- AgentDojo: A Dynamic Environment to Evaluate Prompt Injection Attacks and Defenses for LLM Agents — 97 realistic tasks and 629 security test cases in a dynamic environment. Treats prompt injection ](https://arxiv.org/abs/2506.02456) — VPI-Bench: 306 test cases across five platforms showing malicious visual instructions can manipulate computer-use agent behavior.
- How Microsoft defends against indirect prompt injection attacks — Enterprise guidance on layered defenses: input isolation, detection, provenance separation, governance controls, and deterministic blocking.
- Understanding prompt injections: a frontier security challenge — OpenAI's framing of prompt injection ](https://openai.com/index/designing-agents-to-resist-prompt-injection/) — Agent design guidance emphasizing constraints on risky actions, data protection, and system design that limits damage from successful attacks.
Related posts: