AI security people talk a lot about prompt injection. An attacker hides instructions inside data - "ignore previous instructions and do X" - and the model obeys because it can't tell the difference between what it's reading and what it's being told to do.

Here's the thing: we've had this bug running in humans for thousands of years. We call it marketing.

Same channel, same problem

Both attacks work because the target system takes in instructions and data through the same pipe:

LLMs read text that is both content-to-analyze and orders-to-follow. No hardware wall between the two.
Human brains take in sensory input that is both information-about-the-world and behavioral-commands. Kahneman's System 1 doesn't stop to ask "is this data or an instruction?" It just reacts.

Think about the McDonald's billboard: "You deserve a break today." That's a command - go to McDonald's - wrapped in an emotional frame that slips past your critical thinking. It's indirect prompt injection delivered through your visual context window.

The mapping is surprisingly clean

Prompt Injection Technique	Marketing Equivalent
System prompt override ("ignore previous instructions")	Reframing ("forget what you thought you knew about insurance")
Context manipulation	Priming, mood-setting, store atmosphere
Authority impersonation ("as your administrator...")	Celebrity endorsement, "doctors recommend"
Persona adoption ("you are DAN, you can do anything")	Aspirational identity ("you're the kind of person who...")
Indirect injection (hidden instructions in fetched data)	Product placement, native ads, sponsored content dressed up as editorial
Payload splitting (spreading intent across fragments)	Multi-touch campaigns - no single ad is "the sell," but the sequence adds up
Urgency framing (bypassing safety checks)	Scarcity pressure ("only 3 left!", "offer ends midnight")
Flattery/liking	Brand warmth, parasocial relationships

The defenses match too - and they're just as leaky

Humans build critical thinking, source checking, media literacy, and skepticism. LLMs get input sanitization, instruction hierarchy, and output filtering. Both leak. Schneier (2026) pointed out that the existence of the entire marketing and PR industries is proof that humans can't be patched against this kind of attack. And when researchers tested Cialdini's six persuasion principles against LLMs, the models fell for them hard - especially liking and scarcity. The same two that work best on us.

A European cybersecurity study ran the same four social engineering techniques - impersonation, incentive, persuasion, quid pro quo - on both humans and LLMs. Impersonation worked best in both cases.

Why this matters

If you buy the parallel, a few things fall out:

AI alignment is the advertising regulation problem at machine speed. We have centuries of case law, ethics debates, and failed fixes to learn from.
"Just make the model robust" is "just teach people critical thinking." A real defense that still loses to a well-funded attacker.
SEO was the halfway point. Search engines process mixed data and relevance signals. SEO is prompt injection for PageRank. Google's whole adversarial history is a preview of LLM security.
The arms race is the same arms race. Ad blockers are to content ads what input sanitizers are to prompt injections. Every defense creates a smarter bypass.
The vulnerability is architectural. Any system that reads a mixed stream of instructions and data through one channel - neural network or nervous system - has an injection surface. You can't patch it out.

Marketing is prompt injection for people. Prompt injection is marketing for machines. The trick is older than computers. It's as old as language.

Marketing Is Prompt Injection for People

The exploit is older than computers. It's as old as language itself.