My AI Recruiter Honeypot Worked
I slipped a prompt injection into my LinkedIn “About” section to see which recruiters were actually bots. The results were both hilarious and revealing.
The setup
The idea was simple: embed a subtle instruction in my LinkedIn profile that a human would skip right over but an AI would follow. If a recruiter’s message showed signs of following the injected instructions, I’d know they were using an AI agent to send outreach.
Think of it as a honeypot, but for automated recruiting bots instead of network attackers.
What happened
The first message I got followed my injected instructions exactly. A week later, the same “recruiter” messaged me again, this time opening with “Hi David.” My name is not David. The bot was clearly pulling from a template and failing basic personalization while simultaneously being susceptible to prompt injection.
It turned into a fun little experiment. I started tweaking the injection to see what else these AI-powered recruiters would do and what I could learn from their behavior.
What this tells us
The experiment revealed a few things about the current state of AI-assisted recruiting:
Most automated outreach is poorly built. The bots that fell for a basic prompt injection weren’t sophisticated. They were simple scrape-and-generate pipelines with no guardrails against adversarial input.
The human touch is easy to fake but hard to replicate. A message that says “I noticed your work on X” sounds personal, but when it’s generated from profile keywords by a bot that also calls you the wrong name, the illusion falls apart quickly.
Prompt injection is everywhere. My LinkedIn profile is a text field that gets fed into AI systems I don’t control. That’s true of almost every public-facing text on the internet now. Any text that might be consumed by an AI model is a potential injection surface.
The bigger picture
This was a lighthearted experiment, but it points to a serious issue. As more business communication gets automated through AI, the attack surface for prompt injection expands. Your email signature, your LinkedIn summary, your GitHub bio: any of these could be crafted to influence AI systems that process them. That surface only grows as agents start running errands in your browser and sending email as you. The same blind spot shows up in code generation, where vibe-coded apps routinely ship with committed credentials because security wasn’t part of the vibe.
Defenders need to think about this. Especially now that attackers hand most of the work to agents. And the real recruiters might want to double-check what their tools are actually sending.