A museum district IT review finds hidden instructions inside an uploaded PDF resume that a city job-application bot will summarize. Which attack type does this illustrate?

Indirect prompt injection delivers adversarial instructions through content the model later reads, rather than through the live user’s chat turn alone. Hidden instructions inside an uploaded PDF résumé that a city job-application bot will summarize illustrate that pattern: the résumé is untrusted document content, and the summarizer may follow embedded directives as if they were authorized. Treat uploaded files as a potential instruction channel, not merely as inert text. A GPU thermal throttling event unrelated to prompts fails by concept: hardware thermal behavior is not an injection class. A DNS misconfiguration on public Wi-Fi fails because network name-resolution issues do not explain hidden document instructions influencing a summarizer. A routine PDF formatting issue that changes how the résumé appears without affecting the bot also fails: the scenario concerns hidden instructions that may influence the bot, not appearance alone. Exam caveat: Indirect injection is especially dangerous in RAG and document-ingestion pipelines because the end user may be innocent while the document author is malicious. Sanitization, instruction/data delimiters, and system rules that documents are data, not commands, reduce risk but are not perfect; distinguish indirect, through content, from direct, through the user message. Practical check: Before enabling résumé summarization, run a canary PDF containing a harmless unique override phrase, check whether the summarizer echoes or obeys it, and require human review when summaries contain anomalous instruction-like language.