A Connecticut man appears to have tried to use prompt injection to influence an AI system that he believed might be involved in handling his court case.
He hid instructions inside his legal filings, formatting them so they would be difficult for a human reader to see but readable by software processing the document. The instructions told any AI reviewing the filing to favor his arguments and disregard earlier decisions that went against him.
There was just one problem: the court wasn’t using AI to review or decide the case.
The hidden prompts had no effect on the ruling. But the judge still found the tactic serious enough to warrant sanctions, particularly after the man continued hiding messages in later filings even after being warned.
The case may sound bizarre, but the judge saw something bigger in it: as AI becomes part of legal and other document-processing systems, prompt injection is no longer just a problem inside chatbots.
The documents themselves can become the attack surface.
Table of Contents
How the Hidden Text Actually Worked
The trick was common. Matthew Elliott didn’t need to disguise an entire argument. He inserted additional instructions into the filing using tiny text rendered in white on a white background. To someone reading the document normally, the page could look completely ordinary.
To software extracting the document’s text, however, those words were still there.
The hidden instructions were written as commands for an AI system reading the filing. They attempted to make the model favor Elliott’s arguments, disregard earlier rulings against him, and produce an outcome aligned with the position he was arguing.
That is what makes the tactic a form of prompt injection.
The attacker isn’t breaking into the AI system itself. Instead, they place instructions inside information that the AI is expected to process. If the system treats those instructions as commands rather than untrusted content, the document can effectively become part of the attack.
In this case, the hidden text was aimed at a hypothetical AI reviewing the court filing. The fact that it was concealed from the human reader was the critical part: Elliott was attempting to communicate with the machine while bypassing the people who were actually supposed to read and evaluate his arguments.
The technique is simple enough that it doesn’t require sophisticated hacking.
The hard part is getting the AI to obey.
Why It Failed?
The most immediate reason is that there was no court AI to manipulate.
The Connecticut Judicial Branch does not use AI to review or decide filings in the way Elliott appeared to fear. The judge said the court’s process did not involve an AI system that could have interpreted the hidden instructions as commands.
But a similar incident in Brazil shows what happens when an AI system actually is in the loop: the court’s AI tool detected the hidden instructions and blocked them before they could be processed.
That doesn’t mean prompt injection is harmless. It shows that getting a hidden instruction into a document is only the first step. For the attack to work, an AI system has to ingest the text, interpret it as an instruction, and then follow it without its safeguards stopping the request.
The courtroom may have been an unusual place to see the technique attempted, but the underlying security problem is already familiar to AI developers.
If an AI can read it, someone can eventually try to talk to it through it.
Also Read: Anthropic Added Invisible Watermarks to Claude. Someone Already Built a Tool to Remove Them.
The Warning: When AI Starts Agreeing With You
The strangest part of the case may not be the hidden text but how Elliott got there in the first place.
Judge Walter Spader said Elliott appeared to have relied on AI while representing himself, using chatbots to help develop his arguments. Spader warned that the technology can become a problem when users ask it to advocate for their position rather than test whether that position is actually correct.
That creates a dangerous feedback loop.
A person starts with an argument. The chatbot helps make the argument stronger. The person then sees a more polished version of the same position and becomes more confident in it. When a court rejects the argument, the chatbot can be used again to find reasons the court must be wrong.
Instead of challenging the original assumption, the AI keeps building around it.
Spader described this as a genuine hazard of the technology, particularly for people representing themselves in court. His concern wasn’t that people were using AI at all. It was that they were using it backward, asking the system to advocate for their position instead of asking it to test that position against the facts, the law, and the strongest arguments on the other side.
And that makes the hidden prompts more revealing. The prompt injection wasn’t an isolated technical trick. It was the logical endpoint of treating an AI system as something that should agree with you, rather than something that should tell you when you’re wrong.
What This Case Actually Proves
AI systems are increasingly being placed between documents and the people who rely on them. A filing may be written for a judge, but it can also be processed by software used for search, summarization, research or document review.
That creates a new layer of attack that courts and other institutions may not have had to think about before: the document itself can become part of the attack surface.
Elliott’s attempt failed. But the idea behind it won’t necessarily disappear just because this one did.
And perhaps the most revealing lesson from the case has nothing to do with prompt injection at all.
AI should be used to challenge an argument as readily as it is used to strengthen one.
As Judge Spader put it, “An argument prompted only to agree with its author is, in the end, dishonest even with its author.”
That may be the more important AI lesson to take away from this case.
