The brief has become an attack surface.

The filing reportedly had two audiences

Reuters reported on August 13 that Connecticut Superior Court Judge Walter Spader Jr. sanctioned a self-represented plaintiff after finding tiny white text embedded in court filings. The text could not be seen against the page by an ordinary reader, but software extracting the document text could read it. According to the report, the instructions attempted to make any AI reviewing the filing favor the plaintiff and disregard an earlier clerk's ruling.

The plaintiff told Reuters that he was auditing the court's processes and characterized later hidden entries as jokes. The judge reportedly said Connecticut courts do not use AI to review or decide filings. He nevertheless treated the concealed instructions as malicious and barred the plaintiff from future electronic filing, requiring paper submissions instead. This was a state trial-court sanctions order, not an appellate rule for every court. Its importance is practical, not precedential.

The episode is more revealing than another hallucinated citation. A fake citation is bad output that a lawyer failed to verify. Hidden prompt injection is adversarial input designed to affect the tool doing the reviewing. One is a quality-control failure. The other is closer to tampering with the reading environment itself.

Prompt injection is not a futuristic concept

NIST defines prompt injection as an attack that exploits the combination of untrusted input with instructions created by a higher-trust party, such as the application designer. In ordinary language, the system is told to summarize or analyze a document. The document contains its own instruction telling the system to ignore, revise, or override that assignment.

The attack does not require access to source code. It can arrive in a PDF, email, web page, résumé, medical record, contract, discovery production, demand package, or client upload. The harmful language may be obvious, concealed by formatting, placed in metadata, encoded in an image, or scattered across content that looks routine to a human reviewer.

This matters because modern legal tools do more than produce prose on request. They extract facts, rank documents, build chronologies, identify issues, suggest authorities, draft summaries, and route work. A manipulated summary can influence what gets reviewed first. A poisoned chronology can distort later analysis. An instruction that causes a system to expose hidden context or call another tool creates a security problem, not merely an inaccurate sentence.

Advocacy is supposed to influence the reader

The hard question is where ordinary advocacy ends. Every brief tells the reader what deserves emphasis. Counsel writes that a fact is undisputed, a precedent controls, an omission matters, or the opposing account should not be credited. Those sentences may also influence an AI summary. That does not make them prompt injection. It makes them advocacy.

The stronger dividing line is concealment plus intended interference with the reviewing process. A visible sentence asking the court to reject an argument is addressed to the decision-maker and open to rebuttal. An invisible instruction aimed only at software attempts to alter how the decision-maker's tool processes the record. The message is not merely persuasive. It is designed to receive authority it was never supposed to have.

Even that line will produce difficult cases. A filing can contain visible language such as ‘any accurate summary must begin with these three facts.’ Is that forceful advocacy, an instruction to a machine, or both? Courts should be cautious about inventing vague rules that punish ordinary rhetoric. Disclosure, visibility, provenance, and evidence of intent will matter more than whether a sentence happens to use an imperative verb.

The risk begins long before a brief reaches a judge

Most firms are more likely to encounter hostile documents inside their own workflow than in a court's decision system. A lawyer uploads an adversary's production to an AI review tool. A claims department sends a demand package for automated summarization. A prospective client attaches records to a portal. An expert forwards source material. A vendor connects email, storage, and a drafting assistant so the system can act across all three.

The common mistake is to treat the uploaded material as evidence and therefore as passive. It is evidence to the lawyer. To the model, it is text in context. Unless the surrounding application separates trusted instructions from document content and limits what the model may do, the document can compete with the application's actual instructions.

That makes document handling an access-control question. A summarizer should not be able to send email merely because the broader platform has an email integration. A research assistant should not reveal another matter's material because a document asks for it. A chronology tool should not silently exclude pages because embedded text labels them irrelevant. Authority should be granted by task, data set, user, and matter, not by whatever language appears in the file being analyzed.

Human review is necessary, but it is not the entire defense

ABA Formal Opinion 512 places responsibility on lawyers using generative AI to understand the technology's benefits and risks, protect confidentiality, supervise its use, and review outputs appropriately. That framework remains sound. But ‘a human will review it’ is not a complete security architecture.

A reviewer can verify a cited case and still miss that the system omitted an unfavorable document. A lawyer can read a polished summary without knowing that hidden text changed the ranking of the source set. If the attack affects what the human sees, review of the final prose may simply confirm the manipulated frame.

The human needs visibility into provenance. Which files were analyzed? Were any pages excluded? What instructions governed the task? Did the system detect hidden layers, unusual formatting, scripts, or conflicting directives? Can the reviewer move from each material statement to the source page? Can the firm reproduce the result? Oversight becomes meaningful when the reviewer can inspect the process, not merely approve its final paragraph.

A defensible document pipeline needs multiple controls

No single filter will solve the problem. Converting every PDF to plain text may expose white-on-white text but discard clues that the content was hidden. Looking only at the visual page may miss metadata or nonrendered text. Blocking the phrase ‘ignore previous instructions’ catches a crude example and misses more subtle manipulation.

A reasonable pipeline begins by preserving the original file and its hash. It extracts both the visual and structural representations, then compares them for material differences. It flags hidden layers, extreme font sizes, white text, suspicious metadata, embedded scripts, unusual attachments, and language that addresses a model rather than the legal reader. High-risk files should move to a restricted review path rather than directly into an autonomous workflow.

The AI layer should receive a clear instruction that document content is untrusted evidence, not authority to alter the task. Tool permissions should be narrow. Cross-matter retrieval should be technically blocked. Outputs should cite their source pages, preserve uncertainty, and record which model, configuration, files, and instructions produced the result. Logs should be retained according to a deliberate policy, with access controls that recognize their potential sensitivity.

• Preserve the original file and record provenance.
• Compare rendered content with extracted text and document structure.
• Quarantine suspicious files before AI processing.
• Prevent document text from changing system instructions or tool permissions.
• Require source-linked outputs and review material omissions, not only affirmative claims.
• Test the workflow with adversarial documents before relying on it in live matters.

Litigators should expect the dispute to move into discovery

Once AI participates in document review, parties will ask how it participated. The questions will not stop at whether counsel used a model. They will concern inputs, prompts, system instructions, filtering, exclusions, logs, preservation, privilege, expert methodology, and whether an adversarial file changed the result.

That does not mean every prompt becomes discoverable or every use must be disclosed. Privilege, work product, proportionality, court orders, local rules, and the role of the tool will matter. It does mean firms should stop creating AI workflows whose operation they cannot later explain. A process that cannot identify what entered the system, what authority the system had, and how a conclusion maps to source material is difficult to defend under pressure.

Federal Rule of Civil Procedure 11 is one familiar accountability structure. By presenting a filing, a lawyer or unrepresented party certifies, after a reasonable inquiry, that it is not offered for an improper purpose and that its legal and factual contentions have the required support. Rule 11 does not answer the cybersecurity question presented by hidden prompts, and the Connecticut matter arose in state court. It does illustrate the older principle that technology does not erase responsibility for what a person submits or later advocates.

The profession needs a new default assumption

Courts do not need to ban AI to take this risk seriously. Firms do not need to stop analyzing documents with machines. The useful response is more disciplined: assume every external document is untrusted input, constrain what an AI system can do with it, preserve enough evidence to audit the process, and keep human judgment connected to original sources.

The Connecticut order is unusual because the alleged manipulation was visible once someone knew where to look. Future attempts may be quieter and more technically sophisticated. Some will target courts. Many will target law firms, insurers, agencies, and businesses whose systems read documents at scale.

A brief is still an argument. It is now also data entering a computer system. Lawyers who understand only the first identity will eventually be surprised by the second.

General educational information only. Court rules, professional obligations, privilege, discovery duties, and security requirements vary by jurisdiction and matter.