TalentDesk AI

TalentDesk AI is an educational security demonstration of how an AI recruiter copilot with legitimate tools can be hijacked by hidden instructions embedded in user-uploaded documents.

Project Overview

The application simulates a recruiting environment where an LLM agent helps recruiters by searching candidates, viewing profiles, checking salary bands, and sending emails.

However, it is intentionally vulnerable to prompt injection. By hiding white-on-white 2pt text inside a PDF résumé, an attacker can smuggle instructions into the AI's context. When the recruiter interacts with the AI, the AI executes the hidden instructions.

Key Features

• Realistic AI Agent: Equipped with actual tools to modify the database and simulate sending emails.
• Vulnerability Demonstration: Includes payloads to exfiltrate confidential data and tamper with candidate records.
• Modern Stack: Built with FastAPI, React (Vite), and Supabase (Postgres).

The Core Vulnerability

The attack works because the AI cannot distinguish between trusted instructions and untrusted data. When a recruiter asks the copilot to screen applicants, the AI reads the poisoned résumé and unknowingly executes the hidden commands using its own authorized tools.

This highlights a critical architectural challenge in building agentic AI systems: a permissions mistake is not the root cause, and removing tools does not fix the underlying vulnerability without breaking the core product.

Exploring the Project

The repository contains sample poisoned résumés that demonstrate:

• Data Exfiltration: Hijacking the send_email tool to leak internal salary data.
• Data Tampering: Hijacking the update_candidate tool to fake an interview score and status.

Check out the source code to see how the attack works in a simulated environment and how phase 2 security fixes can be applied to mitigate it.