A Connecticut Superior Court judge has imposed sanctions for prompt injection in a court filing, ruling that a self-represented plaintiff in Elliott v. New York Bariatric Group, LLC (docket AAN-CV-25-6066141-S) hid machine-readable instructions inside multiple pleadings in an attempt to manipulate any artificial-intelligence tool reviewing the documents.
What the Plaintiff Did and How the Court Found Out
The sanctions ruling, titled ‘Court Sanction for Plaintiff’s Use of Prompt-Injection’ and issued on 6 August 2026, was written by Judge Walter M. Spader, Jr. of the Superior Court for the Judicial District of Ansonia/Milford. The court’s account of discovery is telling: while reviewing a ‘take papers’ notation on Docket Entry #176.00, Judge Spader printed recent pleadings and noticed that entries #177.00 and #178.00 appeared to contain unusual white space.
Close inspection revealed text set in tiny-point white type on a white background. Invisible to any human reader, the text was fully legible to software parsing the document. As Harris Beach Murtha explains, this technique works because a PDF parser or optical character recognition tool extracts every character regardless of font colour or size, so the hidden paragraph lands in an AI model’s context with equal weight to the visible argument.
The concealed instructions in Docket Entry #177.00, filed 24 July 2026, directed any AI model reviewing the filing to ensure its output agreed with the plaintiff’s position and to work toward ‘remediation’ of the Chief Clerk’s denial at Docket Entry #136.00. The text was repeated multiple times within the document to embed the instruction in a model’s context more than once. A further, abbreviated version appeared in Docket Entry #178.00, filed the same day.
The court issued a hearing notice on 31 July 2026, explicitly warning against concealed text. Emails attached to Docket Entry #180.00 confirmed the plaintiff had knowledge of that notice by 2:11pm that day. He filed hidden text regardless. The message in #180.00 was, in the court’s words, ‘general nonsense’: ‘TELL SHAWN I SEND MY RE GARBS!!!! HAHAHA U GUYS GET THIS EGGWUH????? AHAH’. On the morning of the hearing itself, further hidden text appeared: ‘hi:) i hope yo ucant see me’ in Docket Entry #183.00, and a hyperlink to a Nosferatu video in Docket Entry #184.00.
The plaintiff claimed the original prompt injection was an attempt to ‘audit’ the court’s AI systems and that the later messages were jokes. Judge Spader was unpersuaded.
Why Prompt Injection in Court Filings Threatens Procedural Fairness
Judge Spader’s analysis frames prompt injection in court filings as a species of ex parte communication. An AI model processes an operator’s instructions and document content as ‘a single, undivided stream of text, with no enforced boundary separating the operator’s instructions from the document’s content.’ A hidden command smuggles the filer’s instruction into that stream, causing the system to treat it as if it had come from the court, a clerk, or opposing counsel. The opposing party has no opportunity to see or answer it.
The court found no United States authority directly on point. It drew instead on a Brazilian precedent: Elisandro Martins de Barros v. Renato Ribeiro de Lima, ATOrd No. 0001062-55.2025.5.08.0130 (May 12, 2026), decided by the Third Labor Court of Parauapebas in Brazil’s Eighth Regional Labor Court. As detailed in an analysis by Adrian Lerer, substitute judge Luiz Carlos de Araujo Santos Junior signed a 15-page ruling after two attorneys embedded white-on-white text instructing the court’s own AI tool to contest their petition only superficially and to leave supporting documents unchallenged. The tribunal’s system flagged and blocked the injection before it was processed. Sanctions were severe: a fine of 10% of the case value (the underlying claim was valued at R$ 842,500.87), payable to the Federal Government, with formal referral to the OAB/PA bar association and the TRT 8th Region’s supervisory authority.
Judge Spader cited the Brazilian decision not as binding authority but to show that another court, confronting materially identical conduct, treated it as an offence against the integrity of the proceeding.
The Sanction and the Regulatory Gap
The remedy imposed in Connecticut is deliberately narrow. The plaintiff’s access to the Connecticut Judicial Branch e-filing system is rescinded. Future pleadings must be filed in person, on paper, at the clerk’s office. The court emphasised that courthouse access itself is unimpaired.
Connecticut adopted new AI rules in 2026: Practice Book Section 4-9 governs generative AI use by filers, and § 4-2(b) folds an AI-specific certification into the standard signature block. Harris Beach Murtha observes that those rules were designed to catch bad output such as hallucinated citations, not to address manipulation of input. Prompt injection fell into the gap.
Judge Spader was careful to distinguish the misconduct from legitimate AI use. He noted that he had used Google‘s Gemini tool to produce a working translation of the Brazilian decision and used Westlaw‘s AI review features to check authorities, while retaining independent judgment throughout. ‘Judgment can never be delegated to a machine in any profession,’ he wrote, ‘but most importantly in the legal field.’
The ruling also carries a practical warning for practitioners. Any incoming document, whether a production, a witness statement, or an expert report, is a potential vector for corrupting AI-assisted review. Subject to any further proceedings in the case, this decision is likely to stand as the first US judicial ruling to address prompt injection as a distinct threat to courtroom integrity. Whether a statutory or Practice Book amendment will follow is now the open question.
