In October 2025, Anthropic published research done jointly with the UK AI Security Institute and the Alan Turing Institute that tested a direct question: how many malicious files does it take to plant unwanted behavior inside an AI model, no matter its size? The answer was 250 documents. Not a fraction of the training data — a fixed number, the same for a small model and for one twenty times larger.
A month earlier, researchers at American universities had measured the other side of the same problem, looking at nearly 200,000 real resumes submitted to companies between 2019 and 2025: about 1% carried hidden instructions, invisible to the human eye, written to convince an AI screening system to approve that resume. The share multiplied sevenfold between July 2024 and November 2025 alone.
Both studies point to the same blind spot: a company does not need to train its own model to be affected. All it takes is an ordinary file — a resume, a commercial proposal, an invoice, a spreadsheet sent by someone outside the company — landing in the archive the AI treats as its source of truth. For whoever decides to invest in company-wide AI, the question stops being "is the AI right?" and becomes "who decided this file could become knowledge?"
A Handful Of Files Can Rewrite Truth
To size up the problem, it helps to separate two moments. Anthropic's study targets the training of the model itself — a rare scenario for the average company, which almost never trains its own AI from scratch. The case that matters for everyday AI use is different: a system that answers by consulting the company's own archive of documents.
In that scenario, an academic study accepted for presentation at the 2025 USENIX Security Symposium tested exactly this: how many malicious texts does it take to manipulate the answer of a system that consults a document archive, with no access to the model or the company's infrastructure — only the ability to place a file where the AI will later look. Five texts were enough to manipulate the answer in 90% of attempts.
That second scenario is the one any company already using AI to answer from its own knowledge is already facing, even without realizing it. A resume sent by a candidate, a commercial proposal from a vendor, an invoice, a spreadsheet received by email: all of these are files that arrive from outside and, in many companies, go straight into a folder or a system the AI already reads.
The international body that gathers AI application security specialists, OWASP, made this risk its own category in the most recent list it publishes: "data and model poisoning" sits among the top ten, right next to hidden instructions embedded in an ordinary document — the same mechanism that lets an everyday resume carry an order no recruiter ever wrote.
For companies across Latin America, the picture is the same, just less discussed in public. HR receives resumes, finance receives invoices and payment slips, procurement receives vendor proposals — and the pressure for AI to "just read all of it and summarize" grows faster than the question of who checks what goes in.
No Antivirus Sees This Threat
The first instinct on hearing this is to reach for traditional security: an antivirus, an attachment filter, a list of banned words. None of the three works, for a simple reason: the file does not carry a virus. It carries text. An antivirus looks for the signature of a malicious program; a hidden instruction inside a resume or a spreadsheet is just a sentence, indistinguishable from any other in the document.
Filtering by keyword does not hold either. The research cited at the opening showed that hidden instructions in resumes evolve faster than any list can anticipate — and most do not even show up as readable text: they use a tiny font in the color of the background, or sit outside the visible area of the page, so a person never sees it while the system that reads the file's text captures it whole.
Reviewing every file by hand does not scale either. A mid-sized company receives hundreds of resumes, invoices, and proposals a month; no team can read every line before letting the AI process them. And here is the core issue: most companies do not treat AI knowledge as a vault — they treat it as a shared folder. Any file that arrives becomes, the very next minute, something the AI can cite as if it were the company's official information.
What Has To Be In Place
An AI environment built for this risk rests on verifiable mechanisms, not on a promise that "our filter catches that."
A gate between "arrived" and "became knowledge." Every file received from outside — resume, proposal, invoice, partner spreadsheet — enters a holding area. It only starts feeding AI answers after a deliberate acceptance step, never automatically the moment it arrives.
Two-step review and approval for critical documents. Whoever receives the file is not, by default, whoever authorizes it to become AI knowledge — that separation is configurable and applies above all to documents that will guide a decision or an internal policy, with segregation of duties and audited exceptions.
A document with an owner and a current version. Every approved piece of knowledge has a responsible person and a date attached — it does not sit loose like any other file in a shared folder.
Access according to each person's role. Not every approved piece of knowledge needs to be visible to everyone; a document from a specific vendor, for instance, stays restricted to whoever works with that vendor.
An audit trail of who approved what. If an AI answer looks off, its origin can be reconstructed — which file, who approved it, when — instead of an investigation that starts from zero.
This is how Skyller was designed: entry through corporate identity, two-step review for critical documents, and an audit trail behind every approved piece of knowledge.
From General Suspicion To Fast Approval
When every external file passes through a gate before becoming knowledge, the effect is not just less risk — it is more speed for whoever does that work. Today, the alternative to a control like this tends to be one extreme or the other: either the team blocks everything from outside until someone "takes a look," and the bottleneck jams HR, finance, and procurement, or nobody looks at anything and every file becomes knowledge automatically.
With a clear approval flow, a recurring vendor's proposal, for example, can be approved once and stay available to whoever needs it every time a question about that contract comes up — without anyone having to reopen the original file. The review work does not repeat itself; it becomes reusable knowledge, credited to whoever approved it.
There is also a gain that only shows up after an incident, when it is too late to prevent it but there is still time to explain what happened: if an AI answer cites incorrect or manipulated information, an audit trail shows where it came from within minutes — instead of an investigation that drags on for weeks trying to reconstruct who sent what.
A Starting Checklist
Before treating this as a hypothetical problem, here is a simple checklist for testing your own AI environment:
- Find out who can feed AI knowledge today. If the answer is "anyone with access to the folder," that is the first gap to close.
- Separate documents that merely inform from ones that decide. A general handbook can survive a passing error; a credit policy or a live contract cannot — those deserve two-step review before becoming AI knowledge.
- Ask who would be notified if a malicious file arrived tomorrow. If the answer is "no one, unless someone gets suspicious of an AI answer," an audit trail is missing.
- Test it with a real file received this week. A resume, a proposal, an invoice: see what happens to it today, from arrival to whether — or not — it becomes available for the AI to use.
