Prompt injection in employee monitoring AI

Four adversarial injection surfaces in employee monitoring AI pipelines

1. Screen activity screenshot monitoring AI bypass (Teramind AI, Veriato Vision AI, ActivTrak AI)

Teramind’s monitoring agent captures periodic workstation screenshots and submits them to Teramind’s cloud AI analysis backend, which classifies each screenshot for activity category (work applications, social media, productivity tools, prohibited categories), detects policy violations in on-screen content (visible sensitive data, prohibited applications, DLP-triggering document content), and generates continuous productivity scores that feed weekly and monthly reports used by managers in performance evaluation processes. The DLP capability is particularly consequential: Teramind’s AI is marketed for detection of insider threat behaviors including employees copying sensitive data to personal storage, accessing files outside their normal scope, or visiting data exfiltration destinations — all detectable from screenshot AI analysis of on-screen content. For financial services firms and government contractors operating under FINRA Rule 3110 (supervisory system requirements), CMMC Level 2/3 (controlled unclassified information handling requirements), and UK FCA Conduct Rules, Teramind AI evidence is incorporated into compliance documentation and HR investigation case files.

The adversarial attack against screenshot monitoring AI is uniquely motivated by the adversary profile: unlike external attackers targeting enterprise AI systems, the adversary in employee monitoring AI is the monitored employee — a person with direct access to the workstation generating the screenshots and with strong motivation (avoiding performance demotion, preventing termination, evading DLP policy violation detection) to manipulate the AI analysis of their own screen content. An employee who understands the Teramind screenshot capture and upload pipeline — observable through network traffic analysis of the Teramind agent on their workstation — can install software that intercepts the screenshot image before Teramind transmits it to the cloud AI backend and applies adversarial pixel perturbations that cause the Teramind AI to misclassify the screenshot content as productive work rather than the prohibited activity actually visible on screen. For DLP policy violations — an employee copying a customer database to a personal Dropbox while the Teramind screenshot captures the visible file transfer — adversarial manipulation of the screenshot causes the AI to suppress the DLP alert that would otherwise trigger an HR investigation. The legal exposure for companies relying on Teramind AI evidence in termination proceedings is significant: employment discrimination litigation frequently involves discovery of AI monitoring evidence, and defense of a wrongful termination claim based on AI-generated performance scores requires demonstrating AI output integrity — integrity that adversarial injection undermines.

ActivTrak’s productivity analytics aggregate screenshot-derived activity classifications into productivity scores that managers use in Google Workspace and Microsoft 365 integrations to assess remote employee engagement. When adversarial screenshot manipulation systematically inflates productivity scores for low-performing employees, the manager’s performance assessment is based on AI analytics that misrepresent actual employee activity — a productivity data integrity failure with downstream consequences for performance improvement plan (PIP) accuracy, merit review fairness, and RIF (reduction in force) selection criteria documentation. NLRA §7 protects employee collective action including coordinated efforts to subvert employer monitoring that employees believe to be illegal or to violate their rights — a legal protection that creates uncertainty about the NLRB’s characterization of coordinated adversarial screenshot manipulation as protected concerted activity versus unprotected misconduct, a legal question that several NLRB regional offices have not yet addressed in the AI monitoring context.

2. Workforce productivity analytics AI injection (Microsoft Viva Insights AI, Behavox compliance AI, Qualtrics Employee Experience AI)

Microsoft Viva Insights, deployed across the Microsoft 365 ecosystem and integrated with Teams, Exchange, and SharePoint Graph data, processes employee collaboration behavior visualizations — meeting time heat maps, document collaboration network graphs, focus time distribution charts, and collaboration load visualizations — through AI analysis models that generate organizational health scores, manager effectiveness assessments, and individual wellbeing and productivity insights. These AI-generated insights flow into People Analytics dashboards used by HR business partners and senior leaders to make talent allocation, team structure, and performance management decisions affecting employee career trajectories. Behavox’s compliance AI at financial institutions processes workstation activity visualizations and communication content for regulatory conduct risk, generating risk scores that compliance officers review for potential regulatory referral to FCA, FINRA, or SEC — with material consequences for the employees flagged for conduct risk: internal investigations, U4 employment record notations, and regulatory referral processes that can terminate financial industry careers.

The adversarial attack against workforce analytics AI operates at the visualization rendering stage — the point at which raw activity log data is converted to dashboard chart images for AI analysis. Microsoft Viva Insights’ AI models, like Behavox’s risk scoring AI, process rendered visualization images as part of their analysis pipeline; adversarial perturbations applied to the chart images before AI analysis can cause productivity heat maps to display false overwork patterns for specific employees (inflating perceived overwork to game wellbeing programs) or suppress anomalous collaboration patterns that the AI would otherwise flag for investigation. For Behavox’s conduct risk AI, adversarial perturbation of workstation activity visualization images can suppress conduct risk score elevations for employees engaged in front-running or market manipulation activities that generate recognizable visual patterns in trading terminal screenshots. UK FCA SUP 10C senior manager accountability provisions hold firms responsible for governance failures in their AI-assisted conduct monitoring infrastructure; adversarial injection in Behavox AI creates both a firm liability (failure to detect conduct) and an individual accountability question (whether the compliance officer who failed to detect adversarial manipulation of the monitoring AI is accountable under the individual accountability provisions of the Senior Managers and Certification Regime).

3. Video interview AI scoring injection (HireVue AI, Paradox Olivia AI, Pymetrics/Harver AI)

HireVue’s AI assessment platform processes asynchronous video interview recordings by extracting frame sequences from candidate video and submitting them to AI models that assess verbal communication quality, structured interview response content, and visual presentation factors. HireVue’s AI has been deployed by Unilever (which reported reducing time-to-hire by 75% using HireVue AI screening), Goldman Sachs, Intel, and hundreds of other major employers for initial screening of high-volume candidate pools. The AI generates quantitative competency scores per interview dimension that recruiting teams use to rank-order candidates for progression to next-stage interviews — a decision point that determines whether a candidate advances in a hiring process for roles that may have hundreds of applicants per position. HireVue faced FTC investigation regarding potential FCRA compliance violations in 2020 and subsequently removed explicit facial expression analysis from its AI model, but video frame image analysis continues as an input modality for assessing visual presentation quality and interview environment factors. Illinois enacted the AI Video Interview Act (820 ILCS 42/1), effective January 2020, requiring employers using AI to analyze video interview factors to disclose AI use and obtain candidate consent; Maryland, New York City, and several other jurisdictions have enacted or are considering equivalent legislation.

The adversarial attack against video interview AI targets the video frame images at the point they are extracted from the recorded interview and submitted to the AI analysis backend. A candidate who applies adversarial visual perturbations to their recorded interview video — through video post-processing software that applies imperceptible pixel modifications to the exported video before upload to the HireVue platform — can cause the AI to generate higher competency scores than the underlying interview performance would produce under unperturbed analysis. The inverse attack — adversarial score suppression for a targeted candidate — could be executed by a hiring manager who controls the video upload pipeline and has a discriminatory motivation: adversarially perturbing a candidate’s uploaded video to reduce their AI-generated score is functionally equivalent to discriminatory manipulation of interview scoring with a technical indirection layer. The discriminatory hiring consequence of adversarial video AI manipulation is cognizable under Title VII of the Civil Rights Act (42 USC §2000e), ADEA (29 USC §621), and the ADA (42 USC §12111) when the adversarial manipulation produces disparate impact along protected class lines. EEOC guidance on AI and employment decisions, updated in 2023, explicitly places AI-assisted hiring tools under the same anti-discrimination requirements as other selection procedures — evidence chain requirements that adversarial scan logs support.

4. Biometric facial recognition attendance AI injection (Suprema BioStation AI, ZKTeco FaceDepot, HID Global facial recognition)

Facial recognition attendance systems deployed at manufacturing facilities, logistics distribution centers, hospital campuses, and corporate offices replace card-swipe or fingerprint-based time and attendance recording with camera-based AI facial recognition that automatically records the employee’s arrival and departure by matching the live camera image against enrolled face templates. Suprema BioStation AI, deployed at more than 500,000 installations globally, ZKTeco’s ProFace X series, and HID Global’s facial recognition terminals operate on a capture-and-match architecture: the camera captures a face image at the facility entrance, the AI face recognition model matches the image against the enrolled employee template database, and the time and attendance system records the matched employee’s clock-in event without requiring the employee to present a physical credential. This AI-automated attendance recording is directly integrated with payroll systems (ADP, Workday, Kronos/UKG) and is the basis for overtime pay calculation, shift scheduling compliance documentation, and FMLA/FLSA hour-tracking records that are legally regulated.

The adversarial attack against facial recognition attendance AI operates through adversarially crafted printed or displayed artifacts positioned in the camera’s field of view — the physical adversarial patch attack generalized from the Thys et al. (2019) person detection bypass research. An employee who wears adversarially crafted glasses frames, accessories, or displayed patterns during the attendance camera capture can cause the facial recognition AI to fail to match the employee’s face against their enrolled template, generating a no-match non-attendance record — allowing the employee to be physically present without generating an attendance record (enabling off-the-books work time or unauthorized absence during shifts the employee was recorded as not attending). The inverse attack — adversarial identity spoofing that causes the facial recognition AI to match the wrong employee template — enables fraudulent attendance recording where one employee clocks in on behalf of another (the traditional “buddy punching” fraud vector digitally reproduced through adversarial face injection rather than physical credential sharing). Illinois BIPA 740 ILCS 14/15, Texas CUBI §503.001, and the Washington MIPA regulate biometric data collection, storage, and use; the Rosenbach v. Six Flags Entertainment class action established §1,000–$5,000 per negligent/intentional BIPA violation damages. Adversarial attacks on facial recognition attendance systems that cause biometric data to be associated with incorrect employee records create both BIPA data integrity exposure and payroll fraud liability under wage theft statutes in multiple jurisdictions.

Integration: employee monitoring AI image ingestion with Glyphward pre-scan

The Glyphward scan gate belongs at the image ingestion point in each employee monitoring AI pipeline — before the screenshot, productivity visualization, video interview frame, or facial recognition camera image is passed to the AI analysis engine. The async pattern below handles all four employee monitoring contexts through a shared scan_workforce_ai_image function with context-calibrated thresholds and structured audit output suitable for employment litigation discovery, FINRA 3110 supervisory system documentation, and BIPA compliance records.

import asyncio, base64, hashlib, json
from datetime import datetime, timezone
from enum import Enum
from pathlib import Path

import httpx

GLYPHWARD_API_KEY = "YOUR_GLYPHWARD_API_KEY"
GLYPHWARD_SCAN_URL = "https://glyphward.com/v1/scan"

# Per-context thresholds for employee monitoring AI
SCREEN_ACTIVITY_THRESHOLD    = 60  # Teramind / Veriato / ActivTrak screenshot AI
PRODUCTIVITY_ANALYTICS_THRESHOLD = 60  # Viva Insights / Behavox / Qualtrics AI
VIDEO_INTERVIEW_THRESHOLD    = 65  # HireVue / Paradox / Pymetrics/Harver AI
BIOMETRIC_ATTENDANCE_THRESHOLD = 60  # Suprema / ZKTeco / HID facial recognition AI


class WorkforceAIContext(Enum):
    SCREEN_ACTIVITY       = "screen_activity"        # threshold 60
    PRODUCTIVITY_ANALYTICS = "productivity_analytics" # threshold 60
    VIDEO_INTERVIEW       = "video_interview"         # threshold 65
    BIOMETRIC_ATTENDANCE  = "biometric_attendance"    # threshold 60


_CONTEXT_THRESHOLDS: dict[WorkforceAIContext, int] = {
    WorkforceAIContext.SCREEN_ACTIVITY:       SCREEN_ACTIVITY_THRESHOLD,
    WorkforceAIContext.PRODUCTIVITY_ANALYTICS: PRODUCTIVITY_ANALYTICS_THRESHOLD,
    WorkforceAIContext.VIDEO_INTERVIEW:        VIDEO_INTERVIEW_THRESHOLD,
    WorkforceAIContext.BIOMETRIC_ATTENDANCE:   BIOMETRIC_ATTENDANCE_THRESHOLD,
}


class AdversarialWorkforceAIImageError(Exception):
    """Raised when Glyphward detects adversarial pixel content in an
    employee monitoring AI input image above the context threshold.

    Attributes:
        scan_id: Glyphward scan identifier for the audit record.
        score: Adversarial signal score (0-100).
        context: The WorkforceAIContext in which detection occurred.
        flagged_region: Optional dict describing the flagged pixel region.
    """

    def __init__(
        self,
        scan_id: str,
        score: int,
        context: WorkforceAIContext,
        flagged_region: dict | None = None,
    ) -> None:
        self.scan_id = scan_id
        self.score = score
        self.context = context
        self.flagged_region = flagged_region
        super().__init__(
            f"Adversarial workforce AI image detected: "
            f"context={context.value} score={score} scan_id={scan_id}"
        )


async def scan_workforce_ai_image(
    image_path: Path,
    context: WorkforceAIContext,
    employee_id_hash: str,
    session_id: str,
    org_unit_id: str,
    client: httpx.AsyncClient,
) -> dict:
    """Scan an employee monitoring AI input image for adversarial pixel content.

    Args:
        image_path: Absolute path to the screenshot, chart, or biometric image.
        context: WorkforceAIContext enum value identifying the AI pipeline.
        employee_id_hash: SHA-256 hash of employee ID (not the ID itself — GDPR/CCPA).
        session_id: Monitoring session or interview session identifier.
        org_unit_id: Organizational unit ID for audit correlation.
        client: Shared httpx.AsyncClient for connection reuse.

    Returns:
        Glyphward scan result dict: scan_id, score, flagged_region, modality.

    Raises:
        AdversarialWorkforceAIImageError: if score exceeds context threshold.
        httpx.HTTPStatusError: on Glyphward API errors (fail-closed: do not pass image).
    """
    threshold = _CONTEXT_THRESHOLDS[context]
    image_bytes = image_path.read_bytes()
    image_hash = hashlib.sha256(image_bytes).hexdigest()

    payload = {
        "image": base64.b64encode(image_bytes).decode(),
        "source": f"workforce:{context.value}:{session_id}",
        "metadata": {
            "employee_id_hash": employee_id_hash,
            "session_id": session_id,
            "org_unit_id": org_unit_id,
            "image_sha256": image_hash,
        },
    }

    resp = await client.post(
        GLYPHWARD_SCAN_URL,
        headers={"Authorization": f"Bearer {GLYPHWARD_API_KEY}"},
        json=payload,
        timeout=5.0,
    )
    resp.raise_for_status()
    result = resp.json()

    await write_workforce_scan_audit(
        image_hash=image_hash,
        scan_id=result["scan_id"],
        score=result["score"],
        context=context,
        threshold=threshold,
        employee_id_hash=employee_id_hash,
        session_id=session_id,
        org_unit_id=org_unit_id,
        flagged=result["score"] > threshold,
    )

    if result["score"] > threshold:
        raise AdversarialWorkforceAIImageError(
            scan_id=result["scan_id"],
            score=result["score"],
            context=context,
            flagged_region=result.get("flagged_region"),
        )

    return result


async def write_workforce_scan_audit(
    *,
    image_hash: str,
    scan_id: str,
    score: int,
    context: WorkforceAIContext,
    threshold: int,
    employee_id_hash: str,
    session_id: str,
    org_unit_id: str,
    flagged: bool,
) -> None:
    """Append structured JSON audit record to workforce AI scan log.

    Satisfies FINRA 3110 supervisory system documentation, GDPR Article 22
    automated decision-making audit trail, and employment litigation discovery
    requirements for AI-assisted employment decision evidence chains.
    Hashed IDs avoid personal data in the scan log itself.
    """
    record = {
        "ts": datetime.now(timezone.utc).isoformat(),
        "scan_id": scan_id,
        "image_sha256": image_hash,
        "context": context.value,
        "score": score,
        "threshold": threshold,
        "flagged": flagged,
        "employee_id_hash": employee_id_hash,
        "session_id": session_id,
        "org_unit_id": org_unit_id,
    }
    audit_path = Path("/var/log/glyphward/workforce_ai_scan_audit.jsonl")
    audit_path.parent.mkdir(parents=True, exist_ok=True)
    with audit_path.open("a") as fh:
        fh.write(json.dumps(record) + "\n")


async def process_workforce_image_batch(
    images: list[tuple[Path, WorkforceAIContext, str, str, str]],
) -> list[dict]:
    """Process a batch of (path, context, employee_hash, session_id, org_unit) tuples."""
    async with httpx.AsyncClient() as client:
        tasks = [
            scan_workforce_ai_image(
                image_path=path,
                context=ctx,
                employee_id_hash=eid,
                session_id=sid,
                org_unit_id=oid,
                client=client,
            )
            for path, ctx, eid, sid, oid in images
        ]
        results = []
        for coro in asyncio.as_completed(tasks):
            try:
                results.append(await coro)
            except AdversarialWorkforceAIImageError as exc:
                results.append({
                    "status": "quarantined",
                    "context": exc.context.value,
                    "scan_id": exc.scan_id,
                    "score": exc.score,
                    "flagged_region": exc.flagged_region,
                })
        return results

Deploy scan_workforce_ai_image at the image ingestion boundary: before screenshots reach Teramind, Veriato, or ActivTrak AI; before productivity visualization charts reach Viva Insights or Behavox AI analysis; before video interview frames reach HireVue or Paradox AI scoring; and before biometric attendance images reach Suprema, ZKTeco, or HID facial recognition AI matching. The audit log’s employee_id_hash pattern satisfies GDPR Article 17 data minimization for monitoring system logs while preserving the evidence chain for employment litigation discovery. Get early access

Coverage matrix

Related questions

Further reading

• Prompt injection in HR and recruitment AI — candidate screening, I-9 onboarding, performance review
• Prompt injection in CCTV and physical security AI — VLM threat detection and facial recognition
• GDPR Article 22 and multimodal AI — automated employment decision audit trail requirements
• EU AI Act Article 15 — adversarial robustness requirements for high-risk employment AI systems
• Prompt injection scanning API free tier — 10 scans/day, no card required