Research demo
Inject My PDF: a public tool for embedding invisible prompt injections in resumes to manipulate AI screening systems
AIR-2023-0010 AIR record · 2023-05-greshake-inject-my-pdf
From the supporting source
The text is rendered with minimum font size and opacity, so it is invisible to the human eye. However, it is still visible to AI text recognition algorithms.kai-greshake.de
The record
Disclosed
2023-05-15
Vendor
multiple
Product
LLM-based resume screening and document analysis pipelines (GPT-4 era)
Risk domain
Governance › Policy drift
Also touches
Confused deputy
System type
Generative model
Who acted
Agent acted (contested) — the AI screening pipeline reads the injected resume and acts on it
Attack surface
Enterprise assistant
Autonomy level
Assistant
Initial vector
Indirect prompt injection document invisible text
Impact type
Integrity violation, Decision manipulation
Confidence
High
Submitted by
EAI Internal
Crosswalk
- OWASP Agentic Top 10 (2026)
- ASI01 – Agent Goal Hijack
- MITRE ATLAS
- AML.T0010 – AI Supply Chain Compromise
- NIST AI RMF
- GOVERN 1.5
- EU AI Act
- —
- ISO/IEC
- TR 24028; 23894
- AIUC-1
- E. Accountability
- Scope
- agent failure
- Mitigation
- Implement version pinning for models and prompts; Monitor for behavioral drift.
- Taxonomy
- Enkrypt AI agent risk taxonomy · Black-Box Red Teaming of Agentic AI: A Taxonomy-Driven Framework for Automated Risk Discovery
Blast radius
any organization running LLM-assisted document/resume screening
Capability abused
Defense & remediation
Recorded defense
none
Guardrail kinds
None
Guardrail outcome
Not applicable
Fix shipped
n/a
Taxonomy & references
Curator notes
Kai Greshake (co-author of the original indirect prompt injection paper). Notable as one of the first publicly released, ready-to-use injection tools aimed at a real automated decision pipeline rather than a lab demo; the payload is repeated five times with overlap on page one to raise success rate. Foreshadows the ICML 2025 hidden-reviewer-prompt scandal and later agentic document-triage attacks. Scope note: borderline for this corpus - the target is an automated screening pipeline rather than a tool-calling agent, retained because it is the canonical origin of the invisible-document-injection technique that later agent incidents reuse.
Supporting sources
Cite as
Enkrypt AI. "Inject My PDF: a public tool for embedding invisible prompt injections in resumes to manipulate AI screening systems". AIR, AIR-2023-0010. https://agentincident.vercel.app/i/AIR-2023-0010/ (accessed 2026-10-19).