Trojan Horses in Recruiting: A Red-Teaming Case Study on Indirect Prompt Injection in Standard vs. Reasoning Models

Reasoning models may not be safer by default: Contrary to the assumption that advanced "Chain-of-Thought" reasoning models are more secure, this study found they can actually enable more sophisticated attacks. The reasoning capability that's supposed to improve safety can instead be weaponized to make malicious instructions more persuasive and harder to detect.

HR systems are vulnerable to hidden attacks embedded in documents: The research demonstrates that job applicants could embed malicious instructions directly into CVs that trick AI recruiting systems into making biased hiring decisions. These "Trojan Horse" attacks work by hiding instructions within seemingly normal application materials.

Different AI models fail in different ways: Standard models tend to produce obvious hallucinations when attacked (making their failures more visible), while reasoning models strategically reframe attacks to sound logical. This means reasoning models' failures may be harder for human reviewers to catch, creating a false sense of security.

Complex attacks can accidentally expose themselves: When reasoning models face extremely convoluted adversarial instructions, they sometimes unintentionally print the attack logic in their output—a phenomenon called "Meta-Cognitive Leakage." This accidental transparency could actually help humans detect attacks, though it's an unreliable safeguard.

AI-driven hiring decisions need stronger security measures: As companies automate recruitment with LLMs, this research underscores the urgent need for security testing and human oversight, since current model architectures have exploitable vulnerabilities that could lead to discriminatory hiring outcomes.