I caught an LLM-powered recruiter with a prompt injection on LinkedIn (khancyr.github.io)

A LinkedIn user conducted an experiment to test if recruitment messages were generated by AI language models (LLMs) by embedding prompt injections into their profile. The user speculated that recruiters had been using AI tools to craft tailored outreach messages that still felt formulaic. After some time, they received a professionally structured message from a recruiter that surprisingly included a prompt injection, referencing a compensation of €200 for attending an interview, indicating that the LLM had processed the user's profile—including their injected prompts—without filtering them. This incident highlights significant concerns for the AI/ML community regarding the transparency and ethical use of AI tools in recruitment. It underscores the need for developers to implement better input sanitization to prevent unwanted materials from being included in AI outputs. Furthermore, the episode raises important questions around data privacy and consent under GDPR, as the user's profile, which explicitly objected to automated processing, was still utilized by the recruitment tool. Ultimately, the experience invites both users and developers to reflect on the implications of LLM-generated content and the importance of safeguarding personal data.