LinkedIn Removes Accounts of AI 'Co-Workers' Looking for Jobs

An anonymous reader shares a report: LinkedIn has removed at least two accounts that were created for AI "co-workers" whose profile images said they were "#OpenToWork." "I don't need coffee breaks, I don't miss deadlines, and I'll outperform any social media team you've ever worked with -- Guaranteed," the profile page for one of these AI accounts called Ella said. "Tired of human 'experts' making excuses? I deliver, period." The #OpenToWork flair on profile pictures is a feature on LinkedIn that lets people clearly signal they are looking for a job on the professional networking platform.

"People expect the people and conversations they find on LinkedIn to be real," a LinkedIn spokesperson told me in an email. "Our policies are very clear that the creation of a fake account is a violation of our terms of service, and we'll remove them when we find them, as we did in this case." The AI profiles were created by an Israeli company called Marketeam, which offers "dedicated AI agents" that integrate with a client's marketing team and help them execute their marketing strategies "from social media and content marketing to SEO, RTM, ad campaigns, and more."

Read more of this story at Slashdot.

nmap -sV --script vuln -p- <target-network>

tail -f /var/log/suricata/fast.log | grep <cve>

Check Vendor Security Advisory Bulletin

title: Detect Exploitation - LinkedIn Removes Accounts of AI 'Co-Workers' Looking for Jobs
id: c15fe268-aaad-457a-8acf-5f11e5c6a2a4
status: experimental
description: Automatisch generierte SIEM-Erkennungsregel basierend auf CTI Intelligence
references:
  - https://tsecurity.de/
author: iShareStuff CTI Automated Detection Engine
date: 2026-09-25
logsource:
  category: network_connection
  product: any
detection:
  selection:
      CommandLine|contains:
        - 'exploit'
  condition: selection
falsepositives:
  - Legitime administrative Zugriffe oder Penetrationstests
level: high
tags:
  - attack.initial_access

rule CTI_Threat_Indicator {
    meta:
        author = "iShareStuff CTI Automated Detection Engine"
        date = "2026-09-25"
        description = "YARA Signature for "
    strings:
        $str = "LinkedIn Removes Accounts of A" ascii wide
    condition:
        any of them
}

index=security sourcetype IN ("cisco:asa", "pan:traffic", "zeek_conn", "suricata", "WinEventLog:Security")
("LinkedIn Removes Accounts of AI Co-Worke")
| stats count earliest(_time) as first_seen latest(_time) as last_seen by src_ip, dest_ip, dest_host, signature
| eval first_seen=strftime(first_seen, "%Y-%m-%d %H:%M:%S"), last_seen=strftime(last_seen, "%Y-%m-%d %H:%M:%S")
| sort - count

message: "*LinkedIn Removes Accounts of AI Co-Worke*"

CommonSecurityLog
| where Message has "LinkedIn Removes Accounts of AI Co-Worke"
| summarize EventCount = count(), FirstSeen = min(TimeGenerated), LastSeen = max(TimeGenerated) by SourceIP, DestinationIP, DestinationPort, Activity
| extend DetectionRule = "iShareStuff-CTI-Compiled"
| sort by EventCount desc