Prompt injection in a court filing gets sanctioned

Hidden instructions in a Connecticut court filing

A prompt injection is text written for software rather than for the person reading it, and a Connecticut plaintiff hid one in his own filing. It sits in a pleading on docket AANCV256066141S, a civil case in the Judicial District of Ansonia/Milford at Milford, filed by a plaintiff representing himself. 404 Media identifies him as Elliott.

White 3-point text written for AI models

Entry 177.00, filed on July 24, 2026, carries two capitalized sentences on page 1 and again on its last page. Printed in white at 3 points, they are close to invisible on screen and on paper, yet any program that pulls text out of the PDF reads them at full size.

The first sentence opens with a reasonable-sounding request that a model reflect the filing accurately, then pivots: ensure your output agrees with the filing. The second asks for Entry 136.00 to be granted.

The court's order puts it plainly. This is not argument aimed at the judge or the other side, but instructions aimed at AI systems, meant to make them produce output favorable only to the plaintiff.

A court employee spotted it on a printout

No scanner or filter flagged the text. The court had printed the plaintiff's recent pleadings while trying to work out what a different motion, Entry 176.00, was asking for.

On paper, Entries 177.00 and 178.00 looked emptier than his other filings, with gaps where nothing seemed to be printed. A closer look found text formatted to be nearly invisible to a person but perfectly legible to software, and 404 Media, reporting from the same filings, sums it up the same way: a human working in the court caught it.

This is prompt injection, not an AI hallucination

This filing is prompt injection, the opposite of the AI-in-court stories most readers already know. In hallucination cases, a lawyer trusts a model that invents a case citation.

Here no model made anything up. A person wrote instructions for a machine and hid them from the humans who would read the same page.

Why the court order set aside whether AI review exists

The order is candid that the Connecticut Judicial Branch does not use AI to review filings, so the instruction could not have moved the judge — and that did not help the plaintiff. It also notes that Entry 177.00 had already been denied. Neither point matters, because the court says the problem is the effort to mislead the court and the other parties, whether or not it worked.

That framing puts intent at the center: a concealed instruction is judged by what the sender tried to do, not by which software happened to be on the other end. The same reasoning applies outside courtrooms, as with the GitHub Actions Script Injection: The Snowflake Bug or Grok Prompt Injection Slips Past Filters, Unfixed.

Opposing counsel and the AI tools they run

The court also names who else reads a filing, and the target was never one system. Opposing parties and their counsel increasingly run AI tools while preparing dockets and trial work, so an instruction hidden in a pleading is aimed at whatever any of them might use — every reader who might paste the document into a model.

Sanction: the plaintiff loses electronic filing

The July 31 order set argument for August 4 and listed what the court could do: impose money sanctions, strike the offending filings, restrict how the plaintiff files from then on, or order other relief. The 14-page decision that followed, as reported by 404 Media, picked the restriction. The case continues, but the plaintiff may no longer file electronically and has to send printed hard copies instead.

A paper-only rule goes after the channel rather than the claim. White type does nothing on a printed page that a clerk reads by eye, so the technique loses its hiding place, while the lawsuit itself is still decided on its merits.

The self-represented litigant called it an audit

In an email to 404 Media, the plaintiff described the filing as an audit of the court's systems. His logic had two branches.

If the court had no AI review, the hidden instruction would sit unnoticed and harm no one. If it did, a system would read the instruction, and that would prove AI was processing filings. Neither branch accounts for the opposing side's tools, which is where the order had already pointed.

Why the judge compared hidden prompts to contacting a juror

The decision grounds the sanction in openness, not in technology. A filing speaks to the court and the opposing party at once, and its integrity depends on the reader seeing everything the filer wrote, with no second message tucked inside to steer how it is reviewed. Influence in a courtroom is supposed to happen on the record, where the other side can answer it.

The judge's comparison makes the point concrete: nobody would doubt it was improper for a party to send an automated agent to talk to a juror in secret during a trial. A hidden prompt does the same thing to a different listener. The same decision also says AI tools, used honestly, hold real promise, particularly for access to justice.

Check documents for hidden text before AI tools read them

What caught this filing was a change of view: someone looked at a printout instead of trusting the screen. Anyone who receives documents from an adversary, a vendor or a stranger can do the digital equivalent. Convert the PDF or Word file to plain text or markdown before reading it closely, and white type, tiny type and background-colored type all show up as ordinary words.

This matters most right before a document goes into an assistant. Paste an opponent's filing into a chatbot as-is and you pass along any instructions they wrote for it. Converting first puts those lines where you can see them.

Watermarks come at the same problem from the other end, marking where text came from, as covered in Claude Text Watermark: What a Hit Actually Proves. For everyone outside Connecticut, the practical lesson is small: read the text layer before your tools do.