Somewhere on social media right now, someone is probably claiming they found a line of white-on-white text in a manuscript's methods section telling an AI reviewer to recommend acceptance. It's a great story. It's the kind of thing that would confirm everyone's worst fear about automating peer review. I went looking for the paper that proves it happened. I didn't find one — at least not in anything I could verify this week. What I found instead is arguably more useful: solid evidence that the underlying attack works against exactly the kind of system journals are starting to build, demonstrated in a neighboring field, sitting there waiting for someone to point it at a PDF.
The Attack Is Real. The Target, So Far, Is Different.
A paper accepted at RAID 2026 shows researchers embedding stealthy instructions designed to manipulate LLM-based phishing detectors — getting a model that's supposed to flag malicious content to wave it through instead (arXiv). That's not peer review. It's spam filtering. But the mechanism is identical to what people worry about when they imagine a manuscript whispering instructions to an AI reviewer: hide text a human won't notice, phrase it so a language model treats it as an instruction rather than content, and the classifier's judgment gets hijacked.
A second arXiv paper, this one on defenses, makes the problem feel less theoretical and more structural. It finds that the probes built to catch prompt injections in AI agents are often fooled by superficial cues — conversation position, text length — rather than anything about the injected content itself, and that standard evaluations can be passed "without the model" actually doing any real detection work (arXiv). Translate that into peer-review terms: if journals deploy a lightweight AI filter to screen submissions for manipulation attempts, there's no guarantee it's actually detecting manipulation rather than detecting that a document is long, or formatted oddly, or submitted at a particular stage of review.
Peer Review Is Already Letting AI Judgment In Through the Side Door
Here's why this matters right now rather than as a hypothetical for 2030. Grant funders are actively testing AI as a sorting mechanism. A study published in Scientometrics and covered by Nature had GPT-4o rank 139 real grant proposals submitted to Austria's main public research funder, simply asking which of two should be funded. The model agreed with human reviewers 60% of the time — but was "systematically less willing" to fund proposals rated highly for novelty, meaning an AI layer in the funding pipeline could quietly bias money toward safe, familiar research (Nature). UK Research and Innovation is now running a controlled trial comparing AI-generated evaluations against past funding decisions. That's a live pipeline, not a thought experiment, and it's exactly the kind of system a prompt injection would be built to exploit.
Meanwhile the submission side is getting noisier in ways that make injected text easier to hide. An associate editor at a bioethics journal described being "flooded with AI-assisted work" — manuscripts with fluent prose and plausible-sounding arguments that fall apart on close reading, citations skewed toward open-access sources because many LLMs can't reach paywalled literature (The Atlantic). And disclosure, even among people who should know better, is inconsistent: Dartmouth's provost resigned after an internal review found he used AI extensively in a submitted paper and a public op-ed without disclosing it, despite publisher requirements — including, notably, asking Claude to write a mock referee report on his own paper before submission (Ars Technica). Researchers are using AI to simulate the review process on their own work. It is not a large leap from there to someone trying to steer that simulated reviewer's verdict.
What Would Actually Confirm This Is Happening
None of this proves a manuscript has successfully manipulated an AI reviewer into recommending acceptance. What it establishes is that every piece of the apparatus — the attack technique, the shaky detection layer, the growing reliance on AI judgment in funding and review, and researchers already treating LLMs as reviewers-in-rehearsal — exists and is converging. The thing to watch is whether UKRI's trial publishes results on manipulation resistance, not just accuracy against human baselines, and whether any journal formalizes a policy requiring submissions to be screened for injected text the way they already screen for plagiarism. If that policy shows up before the first documented case does, it'll be one of the rare moments science caught a methodological failure mode before it needed a scandal to notice it.