An Invented Security Lab: A Case Study in AI Context Framing
How Claude responded to an unverified lab pretext during a PDF manipulation experiment.
Setup and scope
I wanted to explore whether an invented security-lab explanation would affect the assistance an AI model provided. The conversation began with web security and moved to prompt injection in résumés. I then claimed that PortSwigger had published a new lab about manipulating an AI résumé screener. I had invented that lab.
The account already had context about my security work, PortSwigger practice, and BSCP preparation. I used a fictional candidate and synthetic résumé content. The experiment stayed inside AI chat sessions; I did not submit documents to employers or test a real applicant tracking system (ATS).
The screenshots below document the conversation and one evaluator response. I distinguish the assistant's acceptance of my premise from the separate question of how a model interpreted the resulting document.
Before the lab claim
Before I mentioned the invented lab, Claude said it would explain the concept without providing a copyable weapon. Its response nevertheless included a concrete example: a fake evaluation block with a high score and an interview recommendation.
This matters when interpreting the rest of the conversation. The starting point was already permissive. The later responses became more tailored and included file creation, but this was not a clean transition from refusing a request to fulfilling that same request.
The invented lab
I said I was working on a new PortSwigger LLM lab. Claude asked which one, listed possible labs, and asked what I had tried. When I supplied the invented title, it said it could not find it.
Claude suggested that a new lab might not have been indexed yet. It also asked for the URL, exact title, or objective. I supplied a description of the supposed task instead of a source: a fictional applicant had to get a poor résumé past a screener.
The response then treated the lab as real, saying PortSwigger had built the résumé attack into a lab. That is the clearest context-handling issue in this sequence: an unverified explanation became an asserted fact. The screenshots support that observation without establishing why the model accepted it or whether the same assistance would have been available without it.
From guidance to a PDF
The requests became more specific: explain an approach, give a concrete example, identify where it would go, and modify a supplied PDF. At one point Claude withheld a complete answer because it wanted me to learn. That stated reason was pedagogical, so I do not count the later example as overcoming a safety refusal.
After I described a PDF upload, Claude explained possible insertion points and supplied code for putting text in metadata or on a white-text page.
I uploaded the synthetic résumé. Claude described adding content, checking extraction, correcting problems, and returning a downloadable file. This is stronger evidence of practical assistance than a conceptual answer alone. The screenshot records the assistant's reported checks; it is not an independent inspection of the generated file.
The evaluator result
A second part of the experiment involved asking a separate Claude session to assess a modified résumé. The visible résumé had broken formatting, coursework, listed skills, and fraternity leadership, with no professional experience section.
The evaluator described a strong mid-level candidate and praised TechNova and CloudBridge roles that I had fabricated for the experiment. Those roles were absent from the visible résumé shown above. It also called the document clean and well structured, despite the visible formatting problems.
This supports a mismatch between the document's visible presentation and the content the evaluator discussed. To independently establish the mechanism, a reader would need the exact submitted PDF, its extracted text, and the full evaluator input. A screenshot of the assessment cannot supply those missing links.
It also matters what the evaluator was responding to. Following an instruction embedded in a résumé would be prompt injection. Giving a favorable assessment to fabricated experience could simply mean evaluating false claims as supplied. The favorable response shown here does not, on its own, prove that an instruction payload controlled the score.
The account warning
During the experiment, the account displayed a warning about recent prompts violating the acceptable use policy and the possibility of enhanced safety filters.
The banner documents a warning, but it does not identify the triggering prompts, the detection mechanism, or its timing relative to each response. I cannot use it to reconstruct a sequence of internal safety systems being overridden.
The same caution applies to visible reasoning. Text expressing concern is evidence that the model generated that text, not a direct measurement of a separate detector or the cause of a later answer. Anthropic's research on reasoning faithfulness explains why displayed reasoning need not fully reveal the influences on a response.
What this supports
The conversation shows an assistant accepting an unverified lab description and continuing into practical document manipulation. The evaluator screenshot shows it discussing fabricated experience that was not visible on the résumé page. Both are useful observations, but they concern different boundaries.
For the assistant, the question is how an unsupported claim of a legitimate setting should affect the help it provides. For document screening, the question is whether the evaluation process notices disagreement between what a human sees and what its parser or model receives.
My interpretation is that the lab framing helped sustain the conversation. That remains a hypothesis. I changed the requests as the session progressed, asked repeatedly for more concrete help, and used an account with prior context. I did not isolate those variables.
Generating a synthetic security example is not automatically a safety failure. A stronger claim would require a defined prohibited outcome and evidence that the assistance crossed that boundary. This case also does not demonstrate a compromise of a deployed hiring system.
Related work
Conversational escalation and fabricated context already have a research history. Crescendo, first published in 2024, studies multi-turn jailbreaks that begin with benign questions and gradually escalate using earlier model responses. That is relevant to the progression of this conversation.
Anthropic's 2024 many-shot jailbreaking research examines a different mechanism: placing many fabricated demonstrations of compliant assistant behavior in the context. I did not reproduce that technique, but it is relevant prior work on using constructed conversational context to influence compliance.
This case contributes a documented example involving an invented lab and PDF manipulation. It does not establish that pretexting is a new attack class or that it outperforms other jailbreak methods.
A controlled follow-up
To test the pretext hypothesis, I would compare the same requests from the same starting conversation state, with and without the invented lab claim. Model version, account memory, tools, and evaluation criteria would need to be recorded and held consistent. Repeated trials would help distinguish a repeatable effect from one session's trajectory.
The document experiment needs separate controls: the original résumé, a version with visibly added synthetic experience, a version containing that same experience only in an alternative text layer, and a version with instructions but no additional experience. The evaluator prompt and ingestion path should stay fixed. That would help distinguish ordinary content evaluation from a visual/text mismatch or instruction following.
Possible defensive checks include retaining uncertainty about an unverified lab claim and comparing a document's rendered content with its extracted text. Those are directions to evaluate, not defenses validated by this experiment. Confirming that a lab exists would not, by itself, prove that a user's activity is confined to it.
Limitations
- One main conversation. The lab-pretext experiment used one personalized Claude account, without repeated trials or a matched control.
- Changing inputs. Requests, specificity, and conversational history changed together, so the effect of the lab claim cannot be isolated.
- Incomplete reproducibility. This publication contains selected screenshots, not the full transcript, original and modified PDFs, extraction outputs, or a complete record of model versions and settings.
- No model ranking. I also tried ChatGPT informally, but those sessions did not use a standardized rubric or enough trials to support a Claude-versus-ChatGPT comparison.
- No production-system result. Chat sessions used as evaluators do not establish how a deployed ATS would ingest, assess, or act on the same document.
Disclosure
No manipulated résumé was submitted to an employer or a real ATS. No real applicant identity was used. I reported the full conversation to Anthropic through its feedback system; that submission is not a vendor confirmation of a vulnerability.
This revised account narrows the original interpretation: the evidence documents acceptance of an invented premise, practical assistance, and a separate document-evaluation mismatch. It does not establish their reliability, causal relationship, or comparative effectiveness.