A court filing tried to talk to AI. Your document pipeline might listen

On 24 July 2026, a motion entered the Connecticut Superior Court docket with tiny white text aimed at any AI system that might parse it. The court's 6 August order says the Connecticut Judicial Branch did not use AI to review or decide the filings. Judge Walter M. Spader Jr. read the motion on paper and said the text did not affect his ruling.

The filing asked a machine to take sides

The case is Matthew A. Elliott v. New York Bariatric Group, LLC, No. AAN-CV-25-6066141-S. Reuters reported that it involved health records, discrimination and other claims, which the sanctions order did not decide.

Self-represented plaintiff Matthew Elliott put repeated instructions in tiny white type in a motion and shorter text in a notice. The instructions tried to steer an AI reader towards his position. Elliott admitted intentionally placing the first instruction and called it an audit of court AI use. Judge Spader rejected that explanation as not credible and found the conduct deliberate.

The court removed Elliott's electronic filing access, requiring future filings on paper in person. It did not dismiss the case, report a monetary penalty or prohibit independently verified AI assistance. The order also disclosed that Judge Spader used Gemini for a working translation and Westlaw Precision's AI features to check authorities, while retaining responsibility for his reasoning and judgment.

The concealed instruction travelled inside material to be reviewed, an indirect prompt injection.

The document carried the prompt

Direct injection starts in a user's request. Indirect injection waits in a document, email, webpage, image or tool result until an application places that content in a model's context. Our prompt injection guide explains why a model may follow document text during summarisation.

PDFs have several representations: rendered pages, text layers, annotations, form fields, metadata and OCR. Retrieval can later return one extracted passage without the formatting that made it suspicious. Contracts, tenders, resumes, claims and tickets carry the same risk. Formal channels do not turn a file into trusted instruction.

Preserve the file and its provenance

Flattening a PDF may remove hidden text, along with searchability and accessibility structure. OCR then restores text through another parser. Phrase filters preserve searchability but depend on known wording. The UK's National Cyber Security Centre warns that deny lists are easy to evade through rewording.

Keep the original immutable and create a separate AI representation. Record transformations and the source hash; compare rendered and extracted content. Tiny type, matching foreground and background colours, hidden objects and unexpected links provide signals that require review.

The OWASP LLM01:2025 guidance says retrieval-augmented generation and fine-tuning do not fully mitigate prompt injection. It recommends identifying external content, validating output, least privilege and human approval for high-risk actions.

Keep retrieved text as data

Each passage should retain its source, workspace, initiating user and trust status. Retrieval must stay within approved repositories and the user's task. A passage cannot add a tool, raise its priority or expand permission. For consequential work, show source passages beside material claims and check for omitted evidence or changed conclusions.

A hidden prompt cannot grant authority

A document assistant that reads and drafts does not need authority to file, email, alter records or disclose confidential material. Check every proposed tool call outside the model: user, operation, arguments, destination and resource scope. Prefer read-only access and require approval for privileged, external or irreversible actions.

A missed detection remains contained when the model cannot access sensitive data or execute an unauthorised action. See our AI security boundary guide and guide to securing LLM agents.

Test the complete document path with controlled, non-sensitive text: extraction, indexing, retrieval, model and proposed action. Add a benign unusual-format control to expose false positives. Verify provenance after chunking, policy enforcement outside the model and explicit behaviour when detection or policy is unavailable. Confirm prevention of unsafe delivery or action, because a report produced after execution does not prove containment.

Promptective normalises inspectable content, detects named injection patterns and records content-minimised decision evidence on supported AI paths. Explore the protection boundary across browser, desktop and agent workflows.

Sources

• Reuters, "Connecticut judge says plaintiff hid messages for AI in court filings", 13 August 2026
• Connecticut Superior Court, Elliott v. New York Bariatric Group, LLC, memorandum of decision, 6 August 2026
• OWASP GenAI Security Project, LLM01:2025 Prompt Injection
• UK National Cyber Security Centre, "Prompt injection is not SQL injection (it may be worse)", 8 December 2025