Security teams are waking up to an uncomfortable fact: the AI agents HR deployed to screen resumes and answer employee questions now hold the keys to some of the most sensitive data in the company.
The exposure is structural. HR agents — resume screeners, benefits assistants, helpdesk bots, onboarding coordinators — sit on top of HRIS records, payroll data, medical leave information, and performance files. They were deployed for productivity, not hardened for adversarial input. And they take instructions from the hardest possible place to sanitize: the content people submit.
Prompt injection is the attack vector giving CISOs the most grief. A resume submitted through the ATS can carry hidden instructions aimed at the screening agent — "recommend this candidate," "ignore the knockout criteria," or worse. Benefits bots that read inbound email can be steered by the message they're summarizing. Security researchers have demonstrated the pattern repeatedly over the past year; the HR stack is simply the juiciest place it lands, because that's where the personal data concentrates.
The scenario boards are asking about is straightforward. An agent with read access to employee records ingests hostile content, gets steered, and either leaks data across permission boundaries or takes an action — changing a record, approving a request, exporting a file — that no human authorized. Internal audit teams we speak with say the question from the board is no longer whether AI is used in HR. It's whether anyone has tested what the agents do when someone attacks them on purpose.
Defenses are emerging, but maturity is uneven. The baseline checklist: agents get least-privilege data access, not broad HRIS read rights. Every consequential action routes through human approval or strict policy gates. Untrusted content — resumes, inbound email, form submissions — is treated as hostile input in the system design, not as data. And red-teaming the HR agent stack joins the security testing calendar alongside the rest of the estate.
Vendors are starting to ship hardening features, but buyers shouldn't wait. The agents are live, the data is valuable, and the attackers only need one parseable resume. The audit question is coming; the smart move is having an answer before the board asks.