Roughly 2,000 documents in the Duke sample carried a hidden prompt, which is what 1% of nearly 200,000 comes to [14][1]. That is an attempt rate. What the accounts on the record do not contain is a case of a screening model following one of those instructions, or a candidate reaching an interview because it did [18]. In both discovered cases the applicant lost ground rather than gained it [5][12]. The integrity hole is documented at the input, and no measurement yet covers what happens at the output.
The two cases do illuminate detection cost, which is the number an operator can actually act on. One injection surfaced in tooling that was already running, and the other required someone to decide to go looking and upload a batch to an AI tool [2][9]. Simone Lini's sweep covered about 70 files and left roughly 280 unexamined [15]. One hit in 70 is about 1.4% [16], close enough to the study's rate that neither figure embarrasses the other, though a single detection measures nothing on its own.
One percent might read as a rounding error on a hiring funnel, small enough that whatever monitoring already sits in the stack should catch a trick this crude. But exposure lives in the tail, not in the average document. At the measured rate, one 350-application opening should hold three or four injected files [17], and the ones that matter are those sitting where a model helped order the queue. Paul Lee's arrived against a legal and compliance role at his company [2].
The tradeoff is throughput against authorship. Sarah Franklin, CEO of the HR platform Lattice, told Business Insider that employers are overwhelmed with applications and that the process feels to candidates like a complete black box [6]. The volume that makes model-assisted sorting attractive is the same volume that makes writing to the model worth an applicant's five minutes, and Lini said inserting the prompt was not hard to do [12]. So the decision is narrow, and it is about standing: whether a model-produced shortlist binds the next step or merely orders the reading queue.
If it binds, the control is a sweep paid for on every batch, and 20% coverage shows what partial payment buys [9]. If it advises, the injection has to survive a person reading the document. On this record the risk prices as an attempted bypass with an unmeasured success rate, and the near-term consequence is an enforcement pattern rather than an engineering one: word of the tactic is spreading fast enough that some employers now search for prompts deliberately [13], while the tooling that would make the trick inert is not what changed.
