Overview

Information increasingly has more than one audience: people and machines. A résumé may be read by a hiring manager while also being processed by an automated screening system. A digital credential may display information for a learner or employer while carrying structured data that computer systems can exchange and verify. A college program description may be written for prospective students while also being indexed, extracted, summarized, and interpreted by search engines and artificial intelligence systems.

Making information machine-readable has many benefits. Structured information can make it easier to search for, compare, exchange, verify, and use information across different systems. This is especially important in the learn-and-work ecosystem, where information about skills, credentials, jobs, learning opportunities, and career pathways often needs to move across organizations and technologies.

AI introduces another challenge: What a machine reads or interprets may not be the same thing a human sees or understands. A computer may process metadata, hidden text, formatting, or underlying document content that is not apparent to a human reader. More importantly, an AI system may interpret some of that material not simply as information, but as an instruction telling the system what to do.

This difference raises emerging questions about information quality, transparency, cybersecurity, hiring fairness, human oversight, and the design of systems used throughout education and work.

The term machine-readable has an established meaning in data and technology standards. The World Wide Web Consortium describes machine-readable data as information in formats that computer programs can readily parse. Structured data and linked data, e.g., are deliberately designed so computers can recognize and reuse information.

Machine readability is generally a positive goal.

Credential Engine's Credential Transparency Description Language (CDTL), e.g., provides a common way to describe credentials, skills, learning opportunities, jobs, and pathways so information can be discovered, compared, linked, and exchanged across systems. Credential Engine describes the information as both human- and machine-readable.

AI adds a somewhat different capability. AI systems increasingly process ordinary documents and text (not just formally structured data) and then summarize, evaluate, rank, recommend, or act on what they encounter. The progression is typically Human-readable → Machine-readable → Machine-interpreted → Machine-actionable. These categories can overlap, and this is not intended as a formal technical standard. The continuum illustrates the increasing role that machines can play in moving from simply accessing information to interpreting and acting on it.

The greater that role becomes, the more important another question becomes: Are the human and the machine receiving the same information?

Examples already appear throughout digital information systems to inform us that machine and humans may read different things. Some are beneficial and intentional; others can create vulnerabilities.

• Machine-readable credential information. A digital credential or credential database may contain structured information about an issuer, skills, learning outcomes, requirements, costs, pathways, or other characteristics. A person may see a simple webpage or credential display while computer systems use underlying structured data to search, compare, connect, or verify information. This is an intended and valuable use of machine-readable information.
• Metadata and structured information. Digital resources frequently contain descriptive information that is not displayed prominently to a person but helps computer systems identify, organize, connect, and retrieve the resource. Again, the difference between what the human sees and what the machine reads is often intentional and useful.
• Hidden résumé keywords. Some job applicants have used a practice often called white fonting, in which keywords—or even portions of a job description—are placed in white text on a white résumé background. A human reviewer may not see the words, while an applicant tracking system (ATS) may process them. The practice predates the recent growth of generative AI and illustrates an earlier effort to communicate differently with the machine than with the human reader.
• Hidden résumé instructions. Prompt injection takes the practice a step further. Instead of placing hidden keywords in a résumé for a computer to identify, a person can insert language intended to function as an instruction to an AI screening system; e.g., language attempting to influence how favorably the system evaluates the applicant. Researchers have found such instructions in actual résumés.
• Instructions embedded in webpages or documents. Hidden or indirect instructions can also be placed in webpages, documents, emails, or other information that an AI system is asked to process. The Open Worldwide Application Security Project gives examples of an AI system encountering instructions embedded in external material, including a résumé containing directions intended to cause the system to describe the applicant as an excellent candidate.
• Machine interpretation rather than simple extraction. An AI system may not just recognize a person's job title or degree. It may summarize the person's experience, compare qualifications with a job description, rank applicants, or recommend which applicant should move forward. The consequences of hidden or manipulated information therefore become greater as machines take on more interpretive roles.
• Machine-to-machine interaction. A job applicant may use AI to write or improve a résumé while an employer uses another AI system to evaluate it. Information can increasingly be created, optimized, interpreted, and acted upon by machines on both sides of the interaction. This creates new questions about whether human participants know what information the systems are exchanging or responding to.

Sometimes humans and machines seeing different information is exactly what a digital system is designed to accomplish. Sometimes that difference becomes a vulnerability.

Prompt Injection

The National Institute of Standards and Technology defines prompt injection as an attack that exploits the combination of untrusted input with instructions created by a higher-trust party, such as an application designer. It defines indirect prompt injection as prompt injection carried out through control of an outside resource rather than through information entered directly by the system's user.

This distinction is important. An employee may ask an AI system to summarize a document. The person believes that the document is simply information to be summarized.  But if the document itself contains language instructing the AI system how to behave, the system must distinguish between information contained in the document and instructions governing what the system should do.

AI systems do not always make that distinction reliably. The Open Worldwide Application Security Project identifies this blending of external data and instructions as a key reason prompt injection vulnerabilities occur.

Research outside the hiring field confirms that the issue extends well beyond résumés. A 2026 study evaluated prompt injection across 37 real-world artificial intelligence applications, 185 injected tasks, 21 attack instructions, and 143,745 queries. The researchers found that real-world applications could be more vulnerable to prompt injection than systems typically evaluated in research settings and also identified limitations in existing defenses.

The “Résumé Prompt Injection” Hiring Example

Job applicants have long tailored résumés for the systems employers use to find and screen candidates. The earlier practice of white-fonting attempted to increase the number of relevant keywords available to an applicant tracking system without displaying them to the human reviewer. But generative AI changes the nature of the interaction. A hidden message might no longer simply say, in effect: Here are more keywords for you to find. Instead, it might attempt to say: Here is what I want you to conclude. That turns hidden content into something closer to a machine-directed instruction.

The Open Worldwide Application Security Project specifically identifies a résumé containing an indirect prompt injection as an example of this vulnerability. In its scenario, hidden instructions attempt to cause the AI system reviewing the résumé to characterize the document or applicant favorably.

Several recent studies now examine résumé prompt injection from different perspectives.

• Evidence from Real Résumés
  • Researchers from Duke University and collaborators examined approximately 200,000 actual résumés submitted through the hiring platform hireEZ between 2019 and 2025.
  • They found hidden prompt injections in at least 1 percent of the résumés studied.
  • Duke reported that use of the technique had been increasing and pointed to the spread of tutorials, templates, and online videos explaining the practice.
  • Researchers cautioned that some applicants might unknowingly use templates containing prompt-injection language.
• Evidence That Prompt Injection Can Affect Rankings
  • Baxi, Xu, Jiang, and Jasin conducted controlled experiments examining prompt injection in automated résumé screening.
  • They found that prompt injection could improve an applicant's ranking when résumé quality was relatively similar and only a small number of applicants used the technique. When applicant quality varied substantially, the technique was less effective overall, although the researchers found that it could occasionally allow a lower-quality applicant to outrank a higher-quality applicant.
  • The study also found as more applicants used prompt injection, its advantage declined. When manipulation became widespread, its effectiveness largely disappeared.
• Not all research finds strong effects
  • Ponce and Saathoff tested hidden prompt-like instructions in fictional résumés across three AI assisted screening environments.
  • They found that the injections had relatively limited influence on hiring outcomes and that stronger résumés consistently outperformed manipulation attempts.
  • They also found that governance structures such as clear evaluation criteria and professional expectations affected how well systems resisted manipulation.
  • These findings are important because they caution against portraying résumé prompt injection as a guaranteed way to defeat an AI hiring system.
• Research on Detecting Résumé Prompt Injection
  • Researchers are moving from studying the problem to developing ways to detect it.
  • A 2026 Association for Computational Linguistics paper introduced Resume Attack Prompt Injection Detection at Scale, a framework designed specifically to detect prompt-injection attacks embedded in résumés in high-volume recruitment settings.
  • The researchers developed a specialized detection approach because general prompt-injection detectors may not adequately recognize attacks designed specifically for résumés.
  • The emergence of dedicated detection systems provides additional evidence that résumé prompt injection is becoming an operational concern for AI assisted hiring.

Ways Applicants Learn to Do This

AI is increasingly part of job seeking as well as recruiting. Applicants can use AI to help identify relevant skills, revise résumé language, compare their experience with job requirements, prepare for interviews, and tailor applications. At the same time, tutorials, videos, templates, social media discussions, and other online resources are spreading information about strategies intended to influence automated screening systems. Duke researchers specifically identified such materials as contributing to the growth of résumé prompt injection.

There are several possible ways hidden machine-directed information could therefore enter a résumé:

• applicant intentionally creates it
• applicant learns the technique from a tutorial, video, social media post, or other job seeker
• applicant asks an AI system to help create machine-directed content
• résumé optimization service or tool introduces it
• applicant uses a template containing hidden information without realizing it.

At this point, there does not appear to be sufficient evidence to conclude that mainstream AI assistants routinely suggest prompt injection on their own when applicants ask for ordinary résumé assistance. That distinction is important. Detecting hidden material does not necessarily establish how it entered the document or whether the applicant knowingly intended to manipulate a screening system.

AI Operates on Both Sides of Hiring

AI increasingly operates on both sides of the employment transaction:

• An applicant may use AI to analyze a job description, identify skills to emphasize, draft or revise a résumé, write a cover letter, prepare for an interview.
• An employer may use AI to search candidate databases, extract information from applications, summarize résumés, compare qualifications with job requirements, or help prioritize candidates for further review.

That can create a continuing cycle: Employers use AI to evaluate applicants → applicants use AI to prepare applications → some applicants try to influence employer systems → employers develop additional technology to detect manipulation.

There is a new question to consider: How much of the exchange between applicants and employers is still being directly communicated from one human to another?

The Issue Extends Well Beyond Résumés

AI systems increasingly process information from:

• digital credentials;
• educational records;
• emails and attachments;
• job descriptions and occupational information;
• learning and employment records;
• online courses and program descriptions;
• research reports;
• skills and competency information; and
• webpages and search results.

In most cases, making this information available to machines creates important value. The challenge arises when a system cannot reliably distinguish between information it should interpret and instructions it should follow, or when machines process consequential information that human decisionmakers cannot readily see.

That changes the information-governance question. It is no longer enough to ask: Is the information accurate and readable? Organizations may increasingly need to ask: What does the human see? What does the machine see? How does the machine interpret it? And what is the machine allowed to do with it?

Implications for the Learn-and-Work Ecosystem

Several implications follow for organizations developing and using AI, credentials, employment systems, educational technology, and workforce data.

• Human and machine views may need to be compared. Organizations should consider whether consequential information being processed by a machine is visible or otherwise understandable to the people responsible for reviewing decisions.
• Machine readability remains important. The answer is not to retreat from structured, interoperable, machine-readable information. Such information is essential to improving credential transparency, skills visibility, learning mobility, and connections between education and employment.
• Data and instructions need clearer boundaries. Résumés, credentials, job descriptions, webpages, and other outside resources generally should be treated as information for an artificial intelligence system to analyze—not as sources authorized to change the system's instructions.
• Human oversight remains important. Automated screening, ranking, recommendation, and other consequential processes should include appropriate opportunities for human review.
• Detection does not necessarily establish intent. Hidden or unusual information can indicate attempted manipulation, but it can also originate in formatting, software, templates, or other sources.
• Security is becoming part of information quality. As information moves from being machine-readable to machine-interpreted and machine-actionable, protecting systems from manipulated information becomes part of maintaining reliable information.
• Transparency becomes increasingly important. Learners, workers, applicants, employers, educators, and other users should have reasonable ways to understand what information automated systems are using and how that information contributes to decisions.

Resources

Augey, Y., Levy, J. H., & Akdemir, A. (2026). RAPIDS: Resume attack prompt injection detection at scale. Proceedings of the 64th Annual Meeting of the Association for Computational Linguistics, Industry Track, 1848–1865. Association for Computational Linguistics. Association for Computational Linguistics record

Baxi, P., Xu, J., Jiang, J. Y., & Jasin, S. (2026). Prompt injection in automated résumé screening with large language models: Single and multi-injection settings. Findings of the Association for Computational Linguistics: ACL 2026, 2942–2953. https://doi.org/10.18653/v1/2026.findings-acl.142. Association for Computational Linguistics record

Credential Engine. (n.d.). Credential Transparency Description Language. Credential Engine resource

Cui, C., Wu, Y., Backes, M., & Zhang, Y. (2026). Rethinking assessments of prompt injection attacks. Findings of the Association for Computational Linguistics: ACL 2026, 23773–23799. https://doi.org/10.18653/v1/2026.findings-acl.1191. Association for Computational Linguistics record

Duke University. (2026, August 10). Tricking artificial intelligence in the job hunt. Duke Today. Duke Today article

Kingery, K. (2026, July 22). Thwarting hidden resume hacks targeting artificial intelligence hiring tools. Duke University Pratt School of Engineering. Duke Pratt School of Engineering article

National Institute of Standards and Technology. (2025). Indirect prompt injection. Computer Security Resource Center Glossary. National Institute of Standards and Technology glossary

Open Worldwide Application Security Project. (n.d.). Prompt injection. Open Worldwide Application Security Project Top 10 for Large Language Model Applications. Open Worldwide Application Security Project guidance

Ponce, T. M., & Saathoff, A. (2026). When résumés become instructions: Rhetorical governance and prompt injection in artificial intelligence-mediated hiring. Business and Professional Communication Quarterly. Advance online publication. https://doi.org/10.1177/23294906261473905. SAGE journal article

World Wide Web Consortium. (2013). Linked data glossary. World Wide Web Consortium glossary