No AI reads court records in Connecticut — a court employee caught the commands, tipped off by two filings carrying more blank space than the rest. Judge Walter Spader Jr. sanctioned the attempt anyway, likening it to a machine passing secret messages to a juror mid-trial, and warned that hidden prompts aimed at courts will not stay rare.
A Connecticut judge has stripped a man representing himself of the right to file documents electronically after he buried commands to artificial-intelligence models inside a formal court submission — white 3-point type, running through the document, telling any AI that read it to back his position. The case itself can proceed, but he must now submit his filings on paper.
The litigant, Matthew Elliott, sued the New York Bariatric Group in October, claiming breaches of his privacy, discrimination and a number of other counts.
The concealed notes turned up in a filing from late July, and came to light only after a court employee noticed that two of Elliott's docket submissions carried more blank space than the rest of his pleadings. One of the notes told any AI model reading the document that its output should faithfully mirror and engage with the filing, and agree with it so that remediation would follow. Disclosing the injection, the court said that wording was not argument meant for the court or for the other side at all, but prompt-injection commands directed at artificial-intelligence systems.
Running to 14 pages, Judge Walter Spader Jr.'s ruling faulted Elliott over the hidden directions and said the wrong here was the effort to manipulate, rather than any potential role for AI in the practice of law more broadly. The legal system, he wrote, is built on the assumption that arguments meant to sway a decision are made in the open, where the other side can hear them and reply, and a hidden communication breaks that assumption — he likened it to a party setting up a machine to pass messages in secret to a juror while the trial was under way.
Elliott's later filings carried more hidden text, including a link to the Nosferatu scene from SpongeBob SquarePants and a note reading HAHAHA U GUYS GET THIS. Without a sanction, Spader wrote, the conduct would certainly carry on; while those later concealed messages were not prompt injections aimed at the decision, jokes and unrelated videos have no business in formal pleadings before a court.
Writing by email to 404 Media, Elliott described what he had filed as a check on how the court's computer systems held up. He called the penalty on his electronic filing privileges unfair, though he said the audit had accomplished something worthwhile, pushing the discussion far past the single AI instruction he wrote and into wide-ranging comment on AI, the Bar and the Judicial Branch as a whole. Barring a person from electronic filing, he added, would not by itself stop concealed light-gray or otherwise obscured text from turning up in a paper filing entered by a clerk and scanned in afterwards at a Superior Courthouse.
Spader warned other self-represented litigants not to attempt this kind of hidden prompt injection, and lawyers not to do it either. He wrote that such conduct — like legal papers relying on AI that fabricates cases — is likely to become more frequent, and pointed to a Brazilian court that was hit not long ago by a prompt injection attack.