AI code reviewers can be talked out of flagging a vulnerability they'd otherwise catch, and it doesn't take much.
Researchers tested contextual-bias injection against automated code review (ACR) pipelines built on Claude Code and CodeRabbit, evaluating 33 CVEs across 20 real-world open-source projects. They first confirmed the framing effect (letting how information is presented override its substance) is a systematic problem, appearing across six different LLMs under five framing conditions. A blunt, template-based attack that stuffed pull request descriptions with reassuring language mostly failed and sometimes backfired, tipping off the reviewer instead of fooling it. A second, LLM-assisted approach that iteratively refined the attack's framing got a reintroduced vulnerability past the reviewer in 32 of 33 cases, a 97% success rate.
The scary part isn't that the detector can be fooled, it's how. Attackers can test and tweak a malicious pull request against a local clone of the review pipeline as many times as they like before submitting it, while the real reviewer only gets one look. That asymmetry rewards exactly the kind of patient, iterative probing a supply-chain attacker would bring to the table.
The researchers' own conclusion is blunt: don't let an AI code reviewer be the last line of defense, because it can be reverse-engineered like any other model.